### Check for existing issues

- [x] I have searched the existing issues and checked that this is not a duplicate. - Related issues: #15228, #21665 - This appears distinct from #15228 because it is reproducible via direct proxy API calls and points to alias resolution happening after team/virtual-key authorization.

### What happened?

When using LiteLLM Proxy with a model alias configured via the UI, the alias cannot be used in API calls if access is restricted by team / virtual key allowed models.

Example setup:

- Model alias in UI: - `AgentX-LLM` -> `openrouter/qwen/qwen3.5-flash-02-23` - Team / API key has access to: - `openrouter/qwen/qwen3.5-flash-02-23`

Request:

```bash curl -X POST "https://<proxy>/v1/chat/completions" \ -H "Authorization: Bearer <API_KEY>" \ -H "Content-Type: application/json" \ -d '{ "model": "AgentX-LLM", "messages": [ { "role": "user", "content": "say ping" } ] }' ```

Actual behavior:

- Request returns `401 team_model_access_denied` - Logs show LiteLLM checked the alias name directly: - `Tried to access AgentX-LLM`

Expected behavior:

- LiteLLM should resolve the alias first: - `AgentX-LLM` -> `openrouter/qwen/qw…