fix(gateway): close billing, limit, routing and translation gaps

Billing:
- Passthrough SSE streams now bill the usage the upstream reports.
  The gateway falls back to a request-size estimate only on a 2xx
  stream or a truncated JSON body.
- A unified stream that fails after it starts is estimated, not
  billed at zero.
- Billing uses the built-in LiteLLM price table and honours
  modelMeta free: true.
- Pricing entries are validated. Cost arithmetic rounds the total and
  saturates on overflow.
- Gemini thinking tokens count as completion tokens.

Limits and storage:
- A rejected request rolls back its counts on the other scopes, so one
  user cannot lock out a group.
- Redis EXPIRE replies are checked. Keys recreated without a TTL are
  repaired at once.
- A mutating pipeline is not retried after reply bytes arrive.
- History, model totals and target usage report a store outage.

Routing and translation:
- Discovered ids with a provider-like prefix are listed only in
  owner/id form, so listing and routing agree.
- Anthropic and Gemini discovery follows pagination.
- The developer role maps to system.
- stream_options.include_usage is honoured on translated streams.
- tool_choice none keeps tools when history holds tool blocks.
- refusal maps to content_filter. Data URI parameters are stripped.

Streaming, retry and failover:
- SSE accepts CR, LF and CRLF line ends. This closes a CR injection
  path.
- Retry-After is never jittered. A cancelled wait returns the
  context error.
- The watchdog timer stops at end of body.
- Oversized bodies return 413.
- A failed stream ends with an error event.
- Failover restores pre-existing headers. Client cancels do not count
  as provider successes.

Also: "admin" is a reserved provider name. metrics.path must start
with "/". Pricing warnings go to the right gateway instance. The admin
targets view sends access as null or [] so the two states differ.
Upstream organisation headers are stripped. The users-file reload
error is logged once per error. Dead code is removed, and test-only
helpers move to test files.

Claude-Session: https://claude.ai/code/session_01V5jYJNxpDFdJkyyExpADrv

auth_test.go

@@ -28,19 +28,27 @@ func TestIdentify(t *testing.T) {
 	if !ok || u.name != "a" || grp.name != "eng" {
 		t.Fatalf("identify failed: %v %v %v", u, grp, ok)
 	}
-	if !grp.allowsModel("gpt-5-mini") {
+	// allowsModel was removed (review-auth finding F6, 2026-09 audit —
+	// dead in non-test code, and a standalone check would reintroduce the
+	// cross-grant leak allowsProviderModel's per-grant coupling exists to
+	// prevent for a multi-grant principal); these assertions moved to
+	// allowsProviderModel, the real enforcement path every production
+	// caller already uses. "eng" has an empty Providers glob (matches
+	// every provider), so "openai" here exercises that path without
+	// constraining it.
+	if !grp.allowsProviderModel("openai", "gpt-5-mini") {
 		t.Error("glob should match")
 	}
-	// allowsModel is an exact glob against the given string only — it no
-	// longer strips a "provider/" prefix itself (fix(registry) ruling 3): a
+	// The match is an exact glob against the given string only — it does
+	// not strip a "provider/" prefix itself (fix(registry) ruling 3): a
 	// pattern like "gpt-5*" reaching a provider-prefixed request like
-	// "openai/gpt-5-mini" is now the caller's job (modelRegistry.
+	// "openai/gpt-5-mini" is the caller's job (modelRegistry.
 	// resolveAgainst / listFor build the bare-suffix candidate themselves),
 	// covered at the registry level in registry_test.go, not here.
-	if grp.allowsModel("openai/gpt-5-mini") {
-		t.Error("allowsModel must not match a provider-prefixed id on its own; prefix-stripping now lives in the caller")
+	if grp.allowsProviderModel("openai", "openai/gpt-5-mini") {
+		t.Error("must not match a provider-prefixed id on its own; prefix-stripping lives in the caller")
 	}
-	if grp.allowsModel("claude-4") {
+	if grp.allowsProviderModel("openai", "claude-4") {
 		t.Error("should not match")
 	}
 }
@@ -582,10 +590,14 @@ func TestGroup_AllowsAgent_Glob(t *testing.T) {
 	}
 }
 
-func TestGroup_AllowsModel_EmptyListAllowsAnything(t *testing.T) {
+// TestGroup_AllowsProviderModel_EmptyListsAllowAnything moved from the
+// removed allowsModel (review-auth finding F6, 2026-09 audit): both grp's
+// empty Providers and empty Models glob independently mean "allow every
+// value", so any (provider, model) pair matches.
+func TestGroup_AllowsProviderModel_EmptyListsAllowAnything(t *testing.T) {
 	grp := &group{name: "eng"}
-	if !grp.allowsModel("anything-goes") {
-		t.Fatal("empty models list should allow anything")
+	if !grp.allowsProviderModel("any-provider", "anything-goes") {
+		t.Fatal("empty providers and models lists should allow anything")
 	}
 }
 
@@ -593,8 +605,8 @@ func TestGroup_AllowsModel_EmptyListAllowsAnything(t *testing.T) {
 // default for GroupConfig.PassthroughPaths (security+performance audit,
 // 2026-08-22): a group with no PassthroughPaths configured — every group
 // that existed before this field did — must keep reaching every native
-// passthrough path, exactly like allowsProvider/allowsModel/allowsMCP/
-// allowsAgent's own empty-means-all defaults.
+// passthrough path, exactly like allowsProvider/allowsProviderModel/
+// allowsMCP/allowsAgent's own empty-means-all defaults.
 func TestGroup_AllowsPassthroughPath_EmptyListAllowsAll(t *testing.T) {
 	grp := &group{name: "eng"}
 	if !grp.allowsPassthroughPath("v1/files") {