Resolve model sources before replacing role aliases and support legacy
API and OAuth configurations that retain only aliased model entries.
Add regression coverage for source priority, disabled providers,
cross-role updates, and transaction rollback.
