fix: pass client-chosen model/fallback chain through Notes proxy

Proxy ignored the app's model selection and always routed to DeepSeek
via the cheapest provider, so switching models in the app UI had no
effect on the actual request. Now the chosen model and its fallback
chain (limited to the 6 allow-listed IDs) go to OpenRouter; price
stays the sort priority.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server.js

@@ -202,11 +202,28 @@ app.post('/api/notes/chat/completions', async (req, res) => {
       Array.isArray(message.content) &&
       message.content.some((part) => part?.type === 'image_url'),
   );
+  // Die App schickt ihr gewähltes Modell samt Fallback-Kette mit. Nur freigegebene
+  // IDs durchlassen, damit niemand über den Proxy teure Modelle auf unsere Kosten ruft.
+  const NOTES_ALLOWED_MODELS = new Set([
+    'google/gemini-3.8-flash',
+    'google/gemini-3.7-flash',
+    'google/gemini-3.6-flash',
+    'google/gemini-3.5-flash-lite',
+    'google/gemini-3.1-flash-lite',
+    'deepseek/deepseek-v4-flash',
+  ]);
+  const requested = [req.body.model, ...(Array.isArray(req.body.models) ? req.body.models : [])]
+    .filter((id) => NOTES_ALLOWED_MODELS.has(id));
+  const clientModels = [...new Set(requested)].slice(0, 3);
+  // Gemini kann Bilder, DeepSeek V4 Flash nicht — dort bleibt das Vision-Modell.
+  const clientCanSee = clientModels.length > 0 && clientModels[0].startsWith('google/');
   const models = process.env.NOTES_MODEL
     ? [process.env.NOTES_MODEL]
-    : hasImage
-      ? [NOTES_VISION_MODEL]
-      : NOTES_TEXT_MODELS;
+    : clientModels.length > 0 && (!hasImage || clientCanSee)
+      ? clientModels
+      : hasImage
+        ? [NOTES_VISION_MODEL]
+        : NOTES_TEXT_MODELS;
 
   try {
     const upstream = await fetch('https://openrouter.ai/api/v1/chat/completions', {