LiteLLM with MySubs

Builds the upstream LiteLLM proxy image with litellm-mysubs installed in the proxy's existing Python venv. Woodpecker publishes oci.bvoy.dev/homelab/litellm:latest and a commit-SHA tag, using the same registry secret (DOCKER_AUTH_CONFIG) as crdd.

1. Create this repository in Forgejo (homelab/litellm), push to master, enable it in Woodpecker and configure its DOCKER_AUTH_CONFIG secret. Wait for the image to be published before reconciling the Flux change.
2. Reconcile flux/services/ai/litellm/. The deployment uses this image, enables the MySubs callback and mounts a persistent volume for credentials.json and models.json at /app/.litellm/mysubs. Keep the volume private: it holds OAuth refresh tokens. Back it up securely.
3. Sign in as a LiteLLM proxy admin at https://llm.bvoy.dev/mysubs, connect a subscription and paste the browser's final localhost callback URL into the page. Select and apply models. Check /v1/models and try one inference with mysubs/....

store_model_in_db: false is required: LiteLLM's DB reconciliation otherwise removes the models that MySubs injects into the Router. Virtual keys, users and spend logs remain in Postgres; models created via LiteLLM's UI will no longer be database-managed. Do not set STORE_MODEL_IN_DB=True in the environment.

The upstream LiteLLM digest and MySubs version are pinned in Dockerfile. Upgrade deliberately and test the proxy and existing callbacks before changing the production image. MySubs patches internal routing, so upstream version changes can break it.