librechat-sandbox: per-member image billing restored; system key is safety-net only

maintenance/librechat-sandbox.md

@@ -49,14 +49,14 @@ summary.
 
 ## Image generation (two member-facing paths)
 
-1. **MCP tool (default, no key ever, no gate)**: the `inference-image` MCP
-   server exposes `generate_image` in the composer's **+** palette — no agent
-   setup, no key prompt. Images bill to the co-op SYSTEM key
-   (`SYSTEM_IMAGE_KEY`, LiteLLM alias `system-image-fallback`, $5/30d,
-   `regolo/qwen-image` only). No `customUserVars` gate — it made the credential
-   REQUIRED and blocked the whole server for any not-yet-seeded member
-   (first-login gap) before the fallback could run, and v0.8.8 has no optional
-   flag. Per-member image billing is therefore deferred.
+1. **MCP tool (default, no key ever)**: the `inference-image` MCP server
+   exposes `generate_image` in the composer's **+** palette — no agent setup,
+   no key prompt. Per-member billing via `customUserVars.IC_API_KEY` (seeded
+   from the portal) + `env: IC_API_KEY: "{{IC_API_KEY}}"`; a system-key
+   fallback (`system-image-fallback`, $5/30d) covers the rare empty-value
+   case. The `customUserVars` gate blocks a not-yet-seeded member until the
+   next sync (≤10 min) — accepted as a short delay over billing everything
+   to the system account.
 2. **Agent tool**: LibreChat's built-in "OpenAI Image Tools"
    (`IMAGE_GEN_OAI_BASEURL`/`IMAGE_GEN_OAI_MODEL` → gateway; members paste
    their own key — v0.8.8 limitation).