feat(groups): add deny-or-downgrade control for reasoning effort ceiling

OpenAI/Composite groups can now reject requests that exceed the max
reasoning effort instead of always rewriting them down to the ceiling.
Existing groups keep the previous auto-downgrade behavior.

frontend/src/components/admin/group/ReasoningEffortPolicyFields.vue

@@ -17,6 +17,22 @@
       <p class="input-hint">{{ t("admin.groups.form.maxReasoningEffortHint") }}</p>
     </div>
 
+    <div>
+      <label :for="`${idPrefix}-over-limit`" class="input-label">
+        {{ t("admin.groups.form.maxReasoningEffortOverLimit") }}
+      </label>
+      <Select
+        :id="`${idPrefix}-over-limit`"
+        :model-value="overLimit"
+        :options="overLimitOptions"
+        :aria-label="t('admin.groups.form.maxReasoningEffortOverLimit')"
+        :searchable="false"
+        :disabled="!maxEffort"
+        @update:model-value="updateOverLimit"
+      />
+      <p class="input-hint">{{ t("admin.groups.form.maxReasoningEffortOverLimitHint") }}</p>
+    </div>
+
     <div class="border-t border-gray-200 pt-4 dark:border-dark-600">
       <div class="mb-3 flex items-center justify-between gap-3">
         <label class="input-label mb-0">
@@ -120,6 +136,8 @@ import Select from "@/components/common/Select.vue";
 import {
   createReasoningEffortMappingRow,
   reasoningEffortOptionsForPlatform,
+  reasoningEffortOverLimitDeny,
+  reasoningEffortOverLimitDowngrade,
   validateReasoningEffortMappings,
   type ReasoningEffortMappingErrorCode,
   type ReasoningEffortMappingRow,
@@ -129,11 +147,13 @@ const props = defineProps<{
   idPrefix: string;
   platform: GroupPlatform;
   maxEffort: string;
+  overLimit: string;
   mappings: ReasoningEffortMappingRow[];
 }>();
 
 const emit = defineEmits<{
   (event: "update:maxEffort", value: string): void;
+  (event: "update:overLimit", value: string): void;
   (event: "update:mappings", value: ReasoningEffortMappingRow[]): void;
 }>();
 
@@ -142,6 +162,16 @@ const showValidation = ref(false);
 const reasoningEffortOptions = computed(() =>
   reasoningEffortOptionsForPlatform(props.platform),
 );
+const overLimitOptions = computed(() => [
+  {
+    value: reasoningEffortOverLimitDowngrade,
+    label: t("admin.groups.form.maxReasoningEffortOverLimitDowngrade"),
+  },
+  {
+    value: reasoningEffortOverLimitDeny,
+    label: t("admin.groups.form.maxReasoningEffortOverLimitDeny"),
+  },
+]);
 const validationErrors = computed(() =>
   validateReasoningEffortMappings(props.mappings, props.platform),
 );
@@ -153,6 +183,13 @@ const updateMaxEffort = (value: string | number | boolean | null) => {
   emit("update:maxEffort", asString(value));
 };
 
+const updateOverLimit = (value: string | number | boolean | null) => {
+  emit(
+    "update:overLimit",
+    asString(value) || reasoningEffortOverLimitDowngrade,
+  );
+};
+
 const updateMapping = (
   id: string,
   field: "from" | "to",