docs: infrastructure audit — app inventory, backups, CI, provider pricing, agent fleet

Audit of the operator docs against live reality (2026-11-04):
- app-inventory.md: all 19 Cloudron apps with id, fqdn and registry image pin.
  Corrects the portal path (code/member-portal, not co-op/member-portal) and the
  panel path (local/coop.inference.admin-panel, not code/admin-panel).
- maintenance/backups.md: the two backup systems; the deliberate per-user restic
  cache split and the --group-by "" retention fix, with why.
- maintenance/woodpecker-ci.md: CI server + agent, image build/pin, manual-only
  trigger, git-lfs requirement, and its current not-yet-green state (agent's
  job-collection long-poll gets HTTP 500 from the server).
- provider-pricing/: index + GreenPT, Tinfoil (local EHBP proxy architecture) and
  the Metis /v1/systemone decision-model route; regolo.md updated to record the
  gateway prices were applied.
- agent-fleet.md: steward, infrastructure-bot and socialbot (Unix users, gateway
  units, teams); member-bot tier 2 planned but not yet provisioned.
- README: file list; operator-token-runbook: correct the membership_sweep cadence
  (3x daily, not nightly); migration doc: post-migration addendum (16->19 apps,
  DNS split resolved, old box still on with apps stopped).

provider-pricing/README.md

@@ -0,0 +1,44 @@
+# Provider pricing
+
+What our model providers charge, and where the authoritative numbers live.
+
+## The authority
+
+**The gateway's own per-model costs are the authority** — they are what the
+response headers (`x-litellm-response-cost`) and member billing both read. They
+live in the LiteLLM config on the gateway's persistent volume
+(`/app/data/config.yaml`), under each model's `model_info`, as **USD per token**
+(the comments in that file quote per-1M rates). Read them live with
+`GET https://gateway.inference.coop/model/info` (master key), or read the config
+straight from the running app.
+
+**The member-facing mirror** is `co-op/docs/models.md`. When a rate changes,
+update **both** the gateway config and `models.md` — the config is authoritative,
+`models.md` is the mirror.
+
+A missing cost field makes a paid feature free; a stale one bills wrong; a missing
+`cache_read_input_token_cost` bills cache hits at the full input rate. All three
+have happened here.
+
+## The pages
+
+| File | Provider | Notes |
+|---|---|---|
+| `greenpt.md` | GreenPT | renewable energy; the default model lives here |
+| `tinfoil.md` | Tinfoil | TEE; the local-proxy architecture lives here |
+| `regolo.md` | Regolo | renewable + ZDR; includes our measured usage |
+| `decision-model.md` | GreenPT "Metis" via `/v1/systemone` | a pass-through **route**, not a chat model |
+
+## The routing rule
+
+Members reach models through one gateway, which fronts all providers. The
+per-request cost the gateway records is the number to trust; do not re-derive a
+price from a provider's public page (they drift, and some are login-walled).
+
+## A note on currencies
+
+Regolo quotes in **EUR**; our gateway figures convert at **EUR × 1.16 → USD**
+(the rate our numbers use — `regolo.md` documents the derivation). GreenPT's own
+listed rates appear in **EUR with the same numerals the gateway carries** —
+whether an EUR→USD conversion is intended there is **unverified**; confirm it
+against the GreenPT invoice before treating the figures as final.