- Secured node-related endpoints with group-based access control.
- Fixed user preference merging to preserve node attachments.
- Restricted modification and deletion of system skills.
- Hidden administrative node controls for non-admin users.
- Fixed WebSocket connectivity and permission checks for node mesh.
- Filtered node visibility in profile and swarm control to granted nodes only.

- Show model name under each provider button for all users (ProfilePage)
- Admin Settings: upgraded 'Register New Instance' panel with 4 fields:
  provider type, label suffix (with model-name hint), pre-set model
  dropdown, and 'Inherit API Key From' for same-type instance cloning
- Fix API key inheritance: use _clone_from marker instead of copying
  masked key; backend resolves real key from DB before saving
- Lock cloned-key instances: API key field is greyed out with lock icon
  and 'Inherited from <source>' display; Unlink button breaks the link
- Provider card header: show configured model name instead of
  'User Override / System Provided' labels
- ProfilePage: remove confusing 'Do Extra Work' override panel entirely;
  ServiceSelect is now a clean provider selector with no hidden admin UI
- SettingsPage: remove 'User Override' / 'System Provided' badge