## Feature request

Add a prefix-agnostic exact-match option for virtual key `models[]` allowlists, so an allowlist entry of `provider/model` (e.g. `openai/smart-router`) is treated as also matching an incoming request whose `model` field is the bare `model` (e.g. `smart-router`).

## Context

`auth_checks._check_model_access_helper` does strict exact-string match between the request's `model` field and each entry in the virtual key's `models[]` list. That's correct for the simple case where caller, `model_list`, and allowlist all use the same string. It breaks in two adjacent cases we hit in production:

1. **Caller strips the provider prefix.** Some OpenAI-compatible clients (and OpenClaw, which we proxy through LiteLLM) treat the `provider/` part of `provider/model` as an internal routing handle and send only the bare `model` slug in the HTTP request body. Their `model_list` entries match (`model_name: smart-router`), but our allowlist entries are conceptually written as `provider/smart-router` to make it obvious which provider we mean. 2. **Operators want a single canonical form in the allowlist.** Today the workaround is to enumerate every model twice — once as `provider/model…