### Summary

When a custom authentication function returns a user object, the centralized common checks are skipped unless `custom_auth_run_common_checks` is explicitly enabled. The default is `False`, so custom auth integrations can authenticate a request while silently bypassing standard model, team, key, rate, and budget enforcement

### Current behavior

The custom auth builder returns its result directly to the auth pipeline. `_run_centralized_common_checks()` contains an early return equivalent to:

~~~python if user_custom_auth is not None and not general_settings.get( "custom_auth_run_common_checks", False ): return ~~~

The code comments and startup warning explain that DB-backed checks are not run unless the operator opts in. A separate `enable_post_custom_auth_checks` setting covers a different post-auth hook and does not make the centralized common checks run

The same default behavior is duplicated in the WebSocket authentication helper, which makes the behavior dependent on two auth paths

### Reproduction

Configure a custom auth function and omit both common-check flags:

~~~yaml general_settings: custom_auth: my_auth_module.authenticate # custom_auth_ru…