fix: thread timeout_secs through multi-model paths and add system route guard

- Add timeout_secs parameter to gateway_inference_set_multi and pass
  through to SetClusterInferenceRequest
- Add print_timeout to multi-model output display
- Add timeout field to router test helper make_route (upstream added
  timeout to ResolvedRoute)
- Add system route guard: upsert_multi_model_route rejects
  route_name == sandbox-system with InvalidArgument
- Add timeout_secs: 0 to multi-model test ClusterInferenceConfig structs
- Add upsert_multi_model_route_rejects_system_route test

Signed-off-by: Lyle Hopkins <lyle@cosmicnetworks.com>

Author: cosmicnet

crates/openshell-cli/src/run.rs

@@ -3628,6 +3628,15 @@ pub async fn gateway_inference_set_multi(
     }
     print_timeout(configured.timeout_secs);
     if configured.validation_performed {
+        println!("  {}", "Validated Endpoints:".dimmed());
+        for endpoint in configured.validated_endpoints {
+            println!("    - {} ({})", endpoint.url, endpoint.protocol);
+        }
+    }
+    Ok(())
+}
+
+pub async fn gateway_inference_update(
     server: &str,
     provider_name: Option<&str>,
     model_id: Option<&str>,

crates/openshell-router/src/lib.rs

@@ -218,6 +218,7 @@ mod tests {
             protocols: protocols.into_iter().map(String::from).collect(),
             auth: config::AuthHeader::Bearer,
             default_headers: Vec::new(),
+            timeout: std::time::Duration::from_secs(60),
         }
     }
 

crates/openshell-server/src/inference.rs

@@ -254,6 +254,14 @@ async fn upsert_multi_model_route(
         return Err(Status::invalid_argument("models list is empty"));
     }
 
+    // The system route must remain single-model so the sandbox can always
+    // resolve it to exactly one backend without alias selection.
+    if route_name == SANDBOX_SYSTEM_ROUTE_NAME {
+        return Err(Status::invalid_argument(
+            "multi-model is not supported on the system route",
+        ));
+    }
+
     // Names reserved for internal route partitioning (sandbox uses
     // `name == "sandbox-system"` to split user vs system caches).
     const RESERVED_ALIASES: &[&str] = &["sandbox-system", "inference.local"];
@@ -1228,6 +1236,7 @@ mod tests {
             config: Some(ClusterInferenceConfig {
                 provider_name: "openai-dev".to_string(),
                 model_id: "gpt-4o".to_string(),
+                timeout_secs: 0,
                 models: vec![
                     InferenceModelEntry {
                         alias: "my-gpt".to_string(),
@@ -1278,6 +1287,7 @@ mod tests {
             config: Some(ClusterInferenceConfig {
                 provider_name: "openai-dev".to_string(),
                 model_id: "gpt-4o".to_string(),
+                timeout_secs: 0,
                 models: vec![
                     InferenceModelEntry {
                         alias: "my-gpt".to_string(),
@@ -1363,4 +1373,26 @@ mod tests {
         assert_eq!(err.code(), tonic::Code::InvalidArgument);
         assert!(err.message().contains("reserved"));
     }
+
+    #[tokio::test]
+    async fn upsert_multi_model_route_rejects_system_route() {
+        let store = Store::connect("sqlite::memory:?cache=shared")
+            .await
+            .expect("store");
+
+        let openai = make_provider("openai-dev", "openai", "OPENAI_API_KEY", "sk-openai");
+        store.put_message(&openai).await.expect("persist");
+
+        let models = vec![InferenceModelEntry {
+            alias: "fast-gpt".to_string(),
+            provider_name: "openai-dev".to_string(),
+            model_id: "gpt-4o-mini".to_string(),
+        }];
+
+        let err = upsert_multi_model_route(&store, SANDBOX_SYSTEM_ROUTE_NAME, &models, false)
+            .await
+            .expect_err("should reject system route");
+        assert_eq!(err.code(), tonic::Code::InvalidArgument);
+        assert!(err.message().contains("system route"));
+    }
 }