Greptile Summary

This PR fixes the config form analyzer incorrectly marking models.providers as unsupported due to the SecretInputSchema union type (string | secret-ref object).

Key Changes:

• Added isSecretRefVariant() to detect secret-ref object schemas with source/provider/id properties
• Added isSecretRefUnion() to identify unions containing only secret-ref variants
• Added normalizeSecretInputUnion() to normalize secret-input unions to plain string types for form display
• Integrated normalization into normalizeUnion() before literal handling
• Added comprehensive test case validating the fix with models.providers.*.apiKey

Impact:
Users can now edit API keys and other secret fields in the config form UI. The form displays them as string inputs while preserving the underlying union type structure for runtime secret-ref resolution.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The fix is well-implemented with clear logic, follows existing code patterns, and includes thorough test coverage. The changes are minimal and targeted to the specific issue. The logic correctly identifies and normalizes the SecretInput union structure without affecting other union types.
• No files require special attention

_{Last reviewed commit: ab38274}

Landed via temp rebase onto main.

• Gate: pnpm --dir ui test src/ui/config-form.browser.test.ts -t "supports SecretInput unions in additionalProperties maps"
• Land commit: 49f8232
• Merge commit: 534168a

Thanks @ningding97!