Add and remove models from the command line

The last piece of not restarting a control plane to try a model:

  llmgw ctl model add -f qwen-coder-32b.yaml
  llmgw ctl model remove qwen-coder-32b

The file is the same YAML a model takes in server.yaml, read by the same
koanf parser through the same tags, so an entry moves between the two by
being copied and a field that works in one cannot silently mean nothing in
the other.

Wired only when there is a store. A control plane without one says so
rather than accepting a model that vanishes on the next restart, which is
the kind of success that wastes an afternoon. At startup the catalog is
rebuilt from configuration plus what was stored, so models added before a
restart are still there after it — without that the whole feature would be
a slower way to lose work.

Every failure adding a model is the definition being wrong — a collision, a
missing fallback, a profile that cannot be placed — so they are 400s. A 500
would send someone to the server's logs for a mistake in their own file.

The actor comes from the caller and is kept with the row, so a catalog that
has grown over months can say where each entry came from.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

internal/control/adminapi/api_test.go

@@ -3,6 +3,7 @@ package adminapi
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
@@ -246,3 +247,109 @@ func TestEmptyClusterReturnsArraysNotNull(t *testing.T) {
 		}
 	}
 }
+
+type fakeModels struct {
+	added   []catalog.Model
+	actors  []string
+	removed []string
+	err     error
+}
+
+func (f *fakeModels) Add(_ context.Context, m catalog.Model, by string) error {
+	if f.err != nil {
+		return f.err
+	}
+	f.added = append(f.added, m)
+	f.actors = append(f.actors, by)
+	return nil
+}
+
+func (f *fakeModels) Remove(_ context.Context, name string) error {
+	if f.err != nil {
+		return f.err
+	}
+	f.removed = append(f.removed, name)
+	return nil
+}
+
+func TestAddingAModelOverTheAPI(t *testing.T) {
+	a, _ := setup(t, testModels())
+	fm := &fakeModels{}
+	a.SetModels(fm)
+	mux := http.NewServeMux()
+	a.Register(mux)
+
+	body := `{"name":"new","source":"/models/new","profiles":[{"name":"p","engine":"llamacpp"}]}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/models", strings.NewReader(body))
+	req.Header.Set("X-Llmgw-Actor", "ilker")
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	if len(fm.added) != 1 || fm.added[0].Name != "new" {
+		t.Fatalf("added = %+v", fm.added)
+	}
+	// Who made the change, kept so a catalog that grew over months can say
+	// where each entry came from.
+	if len(fm.actors) != 1 || fm.actors[0] != "ilker" {
+		t.Errorf("actor = %v", fm.actors)
+	}
+}
+
+func TestABadModelDefinitionIsTheCallersFault(t *testing.T) {
+	// Every failure here is the definition being wrong — a collision, a missing
+	// fallback, a profile that cannot be placed. None are server faults, and
+	// returning 500 for them would send someone looking at the wrong logs.
+	a, _ := setup(t, testModels())
+	a.SetModels(&fakeModels{err: errors.New("model \"x\" collides")})
+	mux := http.NewServeMux()
+	a.Register(mux)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/models", strings.NewReader(`{"name":"x"}`))
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("status %d, expected 400", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "collides") {
+		t.Errorf("the reason was lost: %s", rec.Body.String())
+	}
+}
+
+func TestWithoutAStoreTheAPIRefusesRatherThanForgets(t *testing.T) {
+	// Accepting a model that vanishes on the next restart is worse than saying
+	// it cannot be kept.
+	a, _ := setup(t, testModels()) // SetModels never called
+	mux := http.NewServeMux()
+	a.Register(mux)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/models", strings.NewReader(`{"name":"x"}`))
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+	if rec.Code != http.StatusNotImplemented {
+		t.Errorf("status %d, expected 501", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "restart") {
+		t.Errorf("the reason does not explain the consequence: %s", rec.Body.String())
+	}
+}
+
+func TestRemovingAModelOverTheAPI(t *testing.T) {
+	a, _ := setup(t, testModels())
+	fm := &fakeModels{}
+	a.SetModels(fm)
+	mux := http.NewServeMux()
+	a.Register(mux)
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/models/gone", nil)
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	if len(fm.removed) != 1 || fm.removed[0] != "gone" {
+		t.Errorf("removed = %v", fm.removed)
+	}
+}