Served model catalog fetch reworked to support API-key and token credentials

What

The "served model catalog" (the list of models Claude Code is allowed to offer) used to only be fetched for full organization accounts, hitting an organization-specific endpoint. Now:

• The fetch branches on the kind of credential in use (organization account, token, or API key), and for token/API-key logins it hits a different, org-less endpoint with an added anthropic-client-platform header.
• A new refusal reason, lane_unavailable, is tracked separately from the existing not_permitted reason, for cases where the org-less route isn't enabled on the server.
• The fetch logic now tracks a "lane" and a resolution object, logging route and credential details, and a stale cached catalog entry is discarded when a lane_unavailable reason is hit.
• The old plain servedCatalogNotPermitted boolean was replaced with a richer servedCatalogRefusal object, and a background tab now explicitly resets its catalog state instead of silently doing nothing.

Why

This lets accounts that log in with a token or API key (rather than a full organization account) get an accurate, up-to-date list of available models, and gives clearer diagnostics when the catalog can't be fetched.