## Summary

`GET /v1/models` correctly filters the model list when `key.models` is set, but silently ignores `user.models`. A user restricted to an access group (e.g. `common-models`) can see the full proxy model list, even though calling any restricted model returns `401 AuthenticationError`.

This is an inconsistency between the model-list endpoint and the inference endpoints:

| Check | `/v1/models` | `/chat/completions` | |-------|-------------|---------------------| | `key.models` | ✅ filtered | ✅ blocked | | `user.models` | ❌ not filtered | ✅ blocked |

## Steps to Reproduce

1. Create a user with `models: ["common-models"]` (an access group containing a subset of proxy models). 2. Call `GET /v1/models` with a key that belongs to this user. 3. **Expected**: only the models in `common-models` are listed. 4. **Actual**: all proxy models are listed.

## Root Cause

`get_available_models_for_user()` in `litellm/proxy/utils.py` builds the model list from the key → team → proxy priority chain but never consults `user.models`. The per-user restriction that `_check_model_access_helper()` applies at inference time has no equivalent in the list path.

## Fix

- Add `get_user_models()` …