### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### The Feature

Allow model access groups to contain other model access groups, enabling hierarchical group composition. When a child group is updated (models added or removed), all parent groups that include it reflect the change automatically — no manual re-synchronization required.

### Example:

``` restricted-models-image → [dall-e-3, stable-diffusion-xl] restricted-models-reasoning → [o1, o3-mini] project-x → [restricted-models-image, restricted-models-reasoning] ```

A key or team assigned `project-x` would have access to all four models. Adding a new model to restricted-models-image later would make it immediately available to project-x as well.

### Motivation, pitch

The current flat model provides no way to group access groups. Organizations that manage multiple named capability tiers (e.g. image generation, reasoning, long-context) and assign combinations of those tiers to internal projects must duplicate model lists across groups manually. This creates maintenance burden and drift risk: adding a new deployment to a capability gr…