### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

On a proxy with managed files enabled, a plain `client.files.list()` from the OpenAI SDK fails with a 500:

``` The api_key client option must be set either by passing api_key to the client or by setting the OPENAI_API_KEY environment variable ```

This affects **every** OpenAI-SDK caller, not an edge case. The SDK's `files.list()` sends no `target_model_names`, and that unscoped form is the one that fails. The scoped form — `GET /v1/files?target_model_names=my-gpt` — succeeds against the same proxy with the same key.

Everything else on the managed path works: upload, retrieve, content, delete, and the entire batch lifecycle. Only enumeration is broken.

The error suggests the unscoped request is being sent to a provider directly rather than through the router, so deployment-scoped credentials in `model_list` are not applied. It fails the same way when a provider is named explicitly (`?provider=openai`, `?custom_llm_provider=openai`, or a `custom-llm-provider` header).

This is on the managed route, not passthrough.

**Expected:** an unscoped …