fix(llm): 模型下拉严格本机构隔离

wwwroot/api/cockpit_model_options.dspy

@@ -1,6 +1,6 @@
 # cockpit_model_options.dspy - Returns active models with capabilities for dropdown
 # Used by cockpit model selector
-# org_id 多租户隔离：非系统级机构只看到「本机构 + 系统级(org_id='0')」的模型
+# org_id 多租户隔离：非系统级机构只看到本机构的模型（不含系统级兜底）
 
 dbname = get_module_dbname('pipeline-sdlc')
 org_id = (await get_userorgid()) or ''
@@ -9,9 +9,9 @@ async with DBPools().sqlorContext(dbname) as sor:
     sql = "SELECT id, name, provider, model_id, capabilities FROM llm WHERE status='active'"
     params = {}
     if org_id and org_id != '0':
-        sql += " AND (org_id=${org}$ OR org_id='0')"
+        sql += " AND org_id=${org}$"
         params['org'] = org_id
-    sql += " ORDER BY (org_id='0') ASC, name"
+    sql += " ORDER BY name"
     recs = await sor.sqlExe(sql, params)
 
 rows = []