Remove per-member model allowlist: members access all gateway models (empty models = all allowed)

app/main.py

@@ -104,7 +104,12 @@ MEMBER_BUDGET = float(os.environ.get("MEMBER_BUDGET", "15.0"))
 REINVITE_AFTER_DAYS = float(os.environ.get("REINVITE_AFTER_DAYS", "3"))
 
 # Models every member key/team may access.
-MEMBER_MODELS = ["deepseek-v4-1-flash", "gpt-oss-120b", "glm-5-3-flash"]
+# Deliberately REMOVED: members get access to every model the gateway serves.
+# The gateway's `model_list` is the single source of truth for what's available;
+# teams and keys carry no per-model restriction (empty = "all models allowed" in
+# LiteLLM). Adding a provider is a gateway-config change only — no team/key
+# migration. (Kept as a documented empty value so the intent is explicit.)
+MEMBER_MODELS: list[str] = []
 
 # The "members" group in Cloudron (group-based access control).
 # Members are assigned to this group, which grants access to the chat app.