Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs