[agent-network] Import agentgateway model-catalog pricing

[danehans]

Issue type

Feature / Enhancement

Source discussion

Follow-up to #6970 and the implementation review in #7274.

Validation owner

@jnfrati

Target repository

netbirdio/netbird

Summary

Agentgateway model discovery exposes model IDs through /v1/models, but does not include its configured model-catalog rates. NetBird therefore applies its own default catalog to exact model IDs. Custom aliases, provider-prefixed IDs, dated IDs, and operator-defined agentgateway prices are not imported and may appear with unknown or zero cost unless an operator manually configures matching NetBird model rows.

Add an explicit, authenticated mechanism for NetBird to import agentgateway model-catalog pricing and associate it with discovered models. NetBird should remain authoritative for the rates distributed to its proxies and shown in its usage views.

Validation evidence

The initial agentgateway integration in #7274 intentionally limits discovery to exact model IDs and decorates them with NetBird catalog defaults. Testing with agentgateway's Kubernetes and standalone model catalogs confirmed that /v1/models does not carry pricing. Agentgateway catalog rates use USD per one million tokens, while NetBird stores rates per one thousand tokens.

Proposed scope

In scope:

• Define a versioned agentgateway pricing-discovery contract or authenticated endpoint rather than assuming prices are present in /v1/models.
• Import rates for exact model IDs and supported token categories, including input, output, cached input, and cache creation where available.
• Convert agentgateway's per-million-token rates to NetBird's per-thousand-token representation without losing precision.
• Define precedence and refresh behavior for imported rates, NetBird defaults, and operator overrides.
• Fail safely when pricing data is missing, malformed, stale, unreachable, or exceeds validation limits. Do not disrupt model routing solely because optional pricing discovery fails.
• Cover aliases explicitly and make limitations clear for dynamic aliases that can route to models with different prices.
• Add unit and integration tests for authentication, conversion, refresh, fallback, and override precedence.

Out of scope:

• Treating agentgateway's catalog as an authorization source.
• Inferring an exact price for a dynamic alias that selects differently priced upstream models.
• Changing the initial routing and trusted-identity behavior in [management,proxy] Add agentgateway integration #7274.

Acceptance criteria

• NetBird can securely retrieve agentgateway catalog pricing for discovered exact model IDs.
• Supported rates are converted correctly from USD per million tokens to NetBird's rate units.
• Operator-defined NetBird prices have documented, deterministic precedence.
• Missing or invalid pricing is visible to operators and does not silently become an authoritative zero rate.
• Pricing refreshes do not weaken model authorization or the trusted identity boundary.
• Tests cover known models, aliases, malformed data, authentication failures, unreachable endpoints, stale data, and dynamic-alias limitations.
• Dashboard and integration documentation explain the source and freshness of imported rates.

Additional context

Initial integration: #7274

Parent issue: #6970

Agentgateway model-cost documentation:
https://agentgateway.dev/docs/kubernetes/latest/llm/cost-controls/costs/

[linear-code]

NET-1578