fix(provider,web): align provider availability predicates and add flow gating

pkg/providers/factory_provider_test.go

@@ -984,8 +984,8 @@ func TestModelProviderOptions(t *testing.T) {
 	}
 	if option, ok := seen["bedrock"]; !ok {
 		t.Fatal("bedrock option missing")
-	} else if option.CreateAllowed {
+	} else if !option.CreateAllowed {
-		t.Fatal("bedrock should not be creatable from the web form")
+		t.Fatal("bedrock should be creatable and defer credential/build errors to runtime")
 	}
 	if option, ok := seen["antigravity"]; !ok {
 		t.Fatal("antigravity option missing")

pkg/providers/provider_catalog.go

@@ -36,7 +36,7 @@ var attachedModelProviderMetaByName = map[string]attachedModelProviderMeta{
 		protocolMeta:  protocolMeta{defaultAPIBase: "https://api.anthropic.com/v1"},
 		createAllowed: true,
 	},
-	"bedrock":        {},
+	"bedrock":        {createAllowed: true},
 	"antigravity":    {createAllowed: true, defaultAuthMethod: "oauth", authMethodLocked: true},
 	"claude-cli":     {createAllowed: true},
 	"codex-cli":      {createAllowed: true},

web/backend/api/model_status.go

@@ -93,7 +93,6 @@ func hasModelConfiguration(m *config.ModelConfig) bool {
 		if configured, checked := hasStoredOAuthCredential(m); checked {
 			return configured
 		}
-		return true
 	}
 
 	if authMethod == "" && providerUsesImplicitOAuth(protocol) {

web/backend/api/models_test.go

@@ -253,6 +253,27 @@ func TestHandleListModels_AvailabilityForOAuthModelWithCredential(t *testing.T)
 	}
 }
 
+func TestHasModelConfiguration_OAuthWithoutMappedCredentialFallsBackToAPIKey(t *testing.T) {
+	noKey := &config.ModelConfig{
+		Provider:   "gemini",
+		Model:      "gemini-2.5-flash",
+		AuthMethod: "oauth",
+	}
+	if hasModelConfiguration(noKey) {
+		t.Fatal("oauth model without credential mapping and api key should be unconfigured")
+	}
+
+	withKey := &config.ModelConfig{
+		Provider:   "gemini",
+		Model:      "gemini-2.5-flash",
+		AuthMethod: "oauth",
+		APIKeys:    config.SimpleSecureStrings("gemini-key"),
+	}
+	if !hasModelConfiguration(withKey) {
+		t.Fatal("oauth model without credential mapping should fall back to api key configuration")
+	}
+}
+
 func TestHandleListModels_AntigravityImplicitOAuthAvailability(t *testing.T) {
 	configPath, cleanup := setupOAuthTestEnv(t)
 	defer cleanup()

web/frontend/src/components/models/models-page.tsx

@@ -47,6 +47,7 @@ export function ModelsPage() {
   const [settingDefaultIndex, setSettingDefaultIndex] = useState<number | null>(
     null,
   )
+  const addDisabled = loading || providerOptions.length === 0
 
   const fetchModels = useCallback(async () => {
     try {
@@ -141,7 +142,12 @@ export function ModelsPage() {
     <div className="flex h-full flex-col">
       <PageHeader title={t("navigation.models")}>
         <div className="flex items-center gap-3">
-          <Button size="sm" variant="outline" onClick={() => setAddOpen(true)}>
+          <Button
+            size="sm"
+            variant="outline"
+            disabled={addDisabled}
+            onClick={() => setAddOpen(true)}
+          >
             <IconPlus className="size-4" />
             {t("models.add.button")}
           </Button>