[vaprdev]

Issue for this PR

N/A. Adding a model to the hardcoded EXCLUDED_MODELS list publishes its name in this public repo.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Adds a StatsHiddenModels SST secret (a comma-separated list, empty by default) to the stats sync service. Models in it are handled like EXCLUDED_MODELS, and rows already stored for them are deleted.

 syncStats
   buildStatsQueries / buildRetentionQueries
-    WHERE lower(model) NOT IN (EXCLUDED_MODELS)
+    WHERE lower(model) NOT IN (EXCLUDED_MODELS + StatsHiddenModels)
   upsert aggregates
   deleteRetiredDimensions
-    model IN RETIRED_STAT_MODELS
+    model IN RETIRED_STAT_MODELS + StatsHiddenModels   # model_stat, geo_stat

• The cleanup only covers the periods the current pass synced. The first pass after a deploy is a full pass, so it clears the whole display window.
• Provider and retention rows are already overwritten on each sync, so they need no change.
• Only StatsSyncService is linked to the secret. The stats app never reads it.

How did you verify your code works?

• bun test src/domain/inference.test.ts: 20 pass. The new test checks that hiddenModels reaches the exclusion list of every usage, geo, and retention query.
• bun run typecheck in packages/stats/core passes.
• The 5 failures in r2-sql.test.ts ("database is locked") also fail on unmodified dev.

Screenshots / recordings

N/A, no UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR