feat(providers): success-rate accounting

Track per-provider and per-(provider,upstream-model) upstream-attempt
outcomes using the existing fixed-window counter machinery (limits.go),
following mcp_a2a.go's per-target counter pattern: kind-embedded keys
(kindProvider="prov", kindProviderModel="provmodel") keep a provider
scope collision-safe against a user/group/MCP-target/agent of the same
name.

limiter.recordProviderAttempt(provider, model, resp, err) increments an
"attempts" counter on every call, and a "failures" counter only for a
provider-fault outcome — reusing retry.go's own isTransient(resp, err)
classification exactly (transport/connection error, HTTP 429, or a 5xx),
not forking it. Both counters are written at minute and day granularity
only; provider health is a now-and-today question, not a billing one, so
there is no month window. limiter.providerUsage batches every scope's
read into one storeGetMulti round trip, mirroring targetUsage's own
single-batch discipline.

Wired at every chokepoint an upstream HTTP attempt resolves:
- providers.go's upstreamJSON/upstreamRawBytes path (chat, embeddings,
  images, audio) via retry.go's retryPolicy.do, which now looks up an
  optional attemptRecorder from ctx and invokes it once per retry
  attempt (attempt-accounting: a request retried twice before
  succeeding reports three attempts, not one).
- routes_unified.go's runUnified (chat/embeddings, streaming and
  non-streaming alike — both funnel through the same upstreamJSON call).
- routes_media.go's three media handlers (images.generations,
  audio.speech, audio.transcriptions).
- routes_passthrough.go's proxyUpstream (native provider passthrough) —
  a single un-retried attempt, provider-level only: the upstream model
  lives in the response body, read only after the attempt resolves.

The attemptRecorder is threaded via context (providers.go's
withAttemptRecorder/attemptRecorderFromContext), not a new function
parameter on every call site — proxyUpstream and retryPolicy.do are
both shared with paths that must NOT record provider accounting
(registry.go's discovery listModels calls, and the MCP/A2A target
proxy, mcp_a2a.go's handleTargetProxy), so scoping via context keeps
their signatures unchanged and those callers correctly opt out by
simply never wrapping their context.

routes_media.go

@@ -96,7 +96,12 @@ func (g *Gateway) handleImagesGenerations(w http.ResponseWriter, r *http.Request
 	}
 	req["model"] = upstreamModel
 
-	if _, err := adapter.imagesGeneration(r.Context(), sw, req); err != nil {
+	// Feature A (v0.22): see routes_unified.go's runUnified for the
+	// identical pattern this mirrors.
+	ctx := withAttemptRecorder(r.Context(), func(resp *http.Response, attemptErr error) {
+		g.limiter.recordProviderAttempt(adapter.name(), upstreamModel, resp, attemptErr)
+	})
+	if _, err := adapter.imagesGeneration(ctx, sw, req); err != nil {
 		g.handleAdapterError(sw, err, adapter.name())
 	}
 }
@@ -145,7 +150,12 @@ func (g *Gateway) handleAudioSpeech(w http.ResponseWriter, r *http.Request, u *u
 		return
 	}
 
-	if _, err := adapter.audioSpeech(r.Context(), sw, body, "application/json"); err != nil {
+	// Feature A (v0.22): see routes_unified.go's runUnified for the
+	// identical pattern this mirrors.
+	ctx := withAttemptRecorder(r.Context(), func(resp *http.Response, attemptErr error) {
+		g.limiter.recordProviderAttempt(adapter.name(), upstreamModel, resp, attemptErr)
+	})
+	if _, err := adapter.audioSpeech(ctx, sw, body, "application/json"); err != nil {
 		g.handleAdapterError(sw, err, adapter.name())
 	}
 }
@@ -230,7 +240,12 @@ func (g *Gateway) handleAudioTranscriptions(w http.ResponseWriter, r *http.Reque
 		uploadContentType = rebuiltContentType
 	}
 
-	if _, err := adapter.audioTranscription(r.Context(), sw, uploadBody, uploadContentType); err != nil {
+	// Feature A (v0.22): see routes_unified.go's runUnified for the
+	// identical pattern this mirrors.
+	ctx := withAttemptRecorder(r.Context(), func(resp *http.Response, attemptErr error) {
+		g.limiter.recordProviderAttempt(adapter.name(), upstreamModel, resp, attemptErr)
+	})
+	if _, err := adapter.audioTranscription(ctx, sw, uploadBody, uploadContentType); err != nil {
 		g.handleAdapterError(sw, err, adapter.name())
 	}
 }