fix(tui): address code review feedback on model picker

- Reset keySaving on back() to prevent blocked key entry after Esc
- Show '(needs setup)' for non-API-key auth providers instead of
  generic '(no key)'
- Set is_current correctly for unauthenticated providers that happen
  to be the active session provider
- Guard model.save_key with is_managed() check — return error on
  managed installs where .env is read-only

tui_gateway/server.py

@@ -4758,7 +4758,7 @@ def _(rid, params: dict) -> dict:
             authenticated.append({
                 "slug": entry.slug,
                 "name": _PROVIDER_LABELS.get(entry.slug, entry.label),
-                "is_current": False,
+                "is_current": entry.slug == current_provider,
                 "is_user_defined": False,
                 "models": [],
                 "total_models": 0,
@@ -4794,7 +4794,7 @@ def _(rid, params: dict) -> dict:
     """
     try:
         from hermes_cli.auth import PROVIDER_REGISTRY
-        from hermes_cli.config import save_env_value
+        from hermes_cli.config import is_managed, save_env_value
         from hermes_cli.model_switch import list_authenticated_providers
 
         slug = (params.get("slug") or "").strip()
@@ -4802,6 +4802,9 @@ def _(rid, params: dict) -> dict:
         if not slug or not api_key:
             return _err(rid, 4001, "slug and api_key are required")
 
+        if is_managed():
+            return _err(rid, 4006, "managed install — credentials are read-only")
+
         pconfig = PROVIDER_REGISTRY.get(slug)
         if not pconfig:
             return _err(rid, 4002, f"unknown provider: {slug}")

ui-tui/src/components/modelPicker.tsx

@@ -78,6 +78,7 @@ export function ModelPicker({ gw, onCancel, onSelect, sessionId, t }: ModelPicke
       setModelIdx(0)
       setKeyInput('')
       setKeyError('')
+      setKeySaving(false)
 
       return
     }
@@ -383,7 +384,9 @@ export function ModelPicker({ gw, onCancel, onSelect, sessionId, t }: ModelPicke
       (p, i) => {
         const authMark = p.authenticated === false ? '○' : p.is_current ? '*' : '●'
         const modelCount = p.total_models ?? p.models?.length ?? 0
-        const suffix = p.authenticated === false ? '(no key)' : `${modelCount} models`
+        const suffix = p.authenticated === false
+          ? (p.auth_type === 'api_key' ? '(no key)' : '(needs setup)')
+          : `${modelCount} models`
 
         return `${authMark} ${names[i]} · ${suffix}`
       }