The providers endpoints now fall back to the caller's own authorized
providers instead of denying, mirroring the usage and log endpoints: a
plain user gets the providers their policies reference — the same
selection the self-service setup answer derives from, now shared through
authorizedProvidersForGroups — reduced to the display surface. A single
provider outside that scope answers not-found, indistinguishable from a
nonexistent one. This feeds the dashboard's provider and model filters on
the self-scoped Usage & Logs view.