fix(model-sync): skip replace when auto-sync returns empty model list

Prevent auto-sync from wiping manually-imported models when the upstream
/models endpoint fails, times out, or returns an empty list. Added
`allowEmpty` option (default false) to replaceCustomModels — callers that
intentionally clear all models (DELETE ?all=true) pass `allowEmpty: true`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/db/models.ts

@@ -429,6 +429,12 @@ export async function replaceCustomModels(
   });
 
   if (merged.length === 0) {
+    // Guard: skip destructive clear when the caller hasn't explicitly opted in.
+    // This prevents auto-sync from wiping manually-imported models when the
+    // upstream /models endpoint fails, times out, or returns an empty list.
+    if (!allowEmpty) {
+      return Array.isArray(existing) ? existing : [];
+    }
     db.prepare("DELETE FROM key_value WHERE namespace = 'customModels' AND key = ?").run(
       providerId
     );