Connection billing, subscription routing, and usage (0.4.0)

[BitL8-ByteShort]

Connecting a subscription-backed model could show “Available” alongside “Unknown — Blocked” because public API pricing was being used as the access gate. Empty SDK-default endpoints and provider-owned authentication transports also caused identity conflicts.

This 0.4.0 change separates configured connection access, billing evidence, public prices, and recorded usage:

• Configured Paid policy permits eligible loaded connections when public estimates are unavailable. Free policy still requires verified zero-price evidence. Existing Paid users retain legacy verified-price behavior until explicitly adopting configured Paid access.
• Empty SDK-default URLs are treated as unspecified; custom endpoints cannot inherit another route's prices. Provider-owned authentication fetch is supported without a subscription-to-API fallback. Revoked, missing, or changed explicit bindings stop dispatch.
• The panel exposes connection billing declarations and provenance, exact role bindings, quota when reported, and historical captured usage grouped by billing kind, binding, and currency. Missing values remain unreported. Refresh and conflicts preserve drafts.
• Planner and MCP reload connection evidence. New explicit pins, binding edits, and billing declarations require current connection revisions. Historical assistant usage is immutable, queued work and retention are bounded, and host disposal flushes pending accounting with a deadline.
• Settings schema 4 and managed surface 3 preserve disabled models and requested pins. Plugin upgrades retain the explicit Connect/update and restart boundary. Exact public 0.3.0 Free/Paid migration checks cover private backups and guarded update/recovery; 0.2.1 coverage remains.

Validation for head 33403f4: complete CI run.

• Full verification passes on Node 22.12.0 and 24.x; 343 tests pass with no skips. Type checking, production build, npm audit, browser tests and CodeQL pass.
• All four exact-package combinations pass: Linux/macOS × Node 22.12.0/24.x. Each runs OpenCode 1.18.22 and 1.18.28 with 20 scenarios and 57 synthetic loopback requests per host, plus 14 browser scenarios against installed production assets with no failures, skips or flakes.
• Every combination verifies actual 0.3.0 Free/Paid and 0.2.1 upgrades, private exact backups, guarded update/restart, MCP, token rotation, disconnect and recovery. The 0.2.1 fixture accounts for its own historical normalization and explicitly checks the disabled choice before migration; 0.3.0 additionally preserves absent disabled identities and pins.
• Damaged plugin/UI artifact checks pass. Public metadata retrieval passes separately with zero inference calls; no real-provider inference was used in acceptance.
• Independent Astra high review findings were fixed and rechecked. New explicit pins cannot bypass the connection revision/binding fence, and usage failure counters use the backend contract.

One candidate was distributed to every CI acceptance job. Downloaded evidence confirms the same SHA-256 throughout:
668d3b8ab17c35abdaf3e3069e8dba0b177c381257b01408262a0049707c565f.
The locally built candidate matches those bytes. This is candidate acceptance evidence, not a final protected-main release artifact.

Limits: synthetic loopback credentials and transports do not prove any real account's entitlement. Opaque host transports are host-managed; quota and unreported token semantics are not invented. Captured history is partial and is not added to aggregate host costs. No merge or publication has occurred; protected-main review, final-artifact acceptance and public release verification remain separate gates.