ranade-oss makes API-key setup stop losing providers

The API Keys page had been relying on a later model-catalogue update to decide which providers to show. When that catalogue arrived incomplete, an already-expanded provider could disappear, even though its credentials still mattered.

ranade-oss now keeps a stable list of credential providers for the page itself, while the separate catalogue still controls which AI models are available. xAI and Moonshot remain visible after loading, and future providers should follow the same rule. The change also adds a test for that future-provider case.