fix(walkthrough): hide unauthenticated models and disable Generate

Do not present a provider without a login as the selected walkthrough
model, and grey out Generate when readiness is false instead of showing
a login-error blocker or raw auth banner.

Co-authored-by: Serhii Dziupin <makeittech@users.noreply.github.com>

packages/web/server/lib/walkthrough/DOCUMENTATION.md

@@ -121,9 +121,10 @@ silently changes the model behind commit messages.
 A settings or `opencode.json` `small_model` override can still name a provider
 with no usable login (neither `auth.json` nor `provider.<id>.options.apiKey`).
 `describeSmallModel` reports that as `hasLogin: false`, readiness refuses with
-`code: 'no-provider-login'`, and generation maps the same code to HTTP 401 —
-so the panel shows a blocker with a model picker instead of looking ready and
-then dumping the raw `No OpenCode login found for provider "…"` string.
+`reason: 'no-provider-login'` and omits the unusable model so the panel cannot
+present it as selected, and generation maps the same code to HTTP 401. The UI
+disables Generate and keeps the picker on authenticated providers only — it does
+not surface a raw auth error or a special login blocker for this case.
 
 ## Output language
 

packages/web/server/lib/walkthrough/index.js

@@ -334,9 +334,10 @@ function computeReadiness({ model, digest, files, fileCount, hunkCount, generate
   }
 
   // A resolved override/config model can still have no usable login. Refuse up
-  // front so the panel does not look ready and then dump a raw auth error.
+  // front and omit the model — offering an unauthenticated selection in the
+  // picker is what made the old raw auth error feel like a product bug.
   if (model.hasLogin === false) {
-    return { ready: false, reason: 'no-provider-login', model };
+    return { ready: false, reason: 'no-provider-login' };
   }
 
   // Built with the same language the generation would use: the instruction is

packages/web/server/lib/walkthrough/reproduce-2607.test.js

@@ -90,11 +90,8 @@ describe('issue 2607 — walkthrough blocks unauthenticated providers', () => {
 
     expect(result.readiness.ready).toBe(false);
     expect(result.readiness.reason).toBe('no-provider-login');
-    expect(result.readiness.model).toMatchObject({
-      providerID: 'deepseek',
-      modelID: 'deepseek-v4-flash',
-      hasLogin: false,
-    });
+    // Unusable models must not be offered as the current selection.
+    expect(result.readiness.model).toBeUndefined();
   });
 
   it('callSmallModel throws a structured no-provider-login error', async () => {