gateway: let member keys reach the Metis pass-through route

LiteLLM gates auth=true pass-through routes behind allowed_passthrough_routes,
a LiteLLM Enterprise field: on this community-edition proxy the management API
refuses to set it, so no member key can ever be granted access, and auth:false
would instead expose the route (and our GreenPT key) to anonymous callers.

Add patch_passthrough_key_access.py (house style: build-time, non-fatal,
idempotent, compile-checked) so routes the operator names in
general_settings.coop_passthrough_open_to_keys are callable by ANY
authenticated key. Authentication itself is unchanged: auth=true still installs
Depends(user_api_key_auth), so unauthenticated requests are still rejected.

Validated locally against LiteLLM 1.103.2: a plain generated key gets 200 with
real Metis answers; an unauthenticated POST gets 401.

Dockerfile

@@ -66,6 +66,16 @@ RUN python3 /app/code/patch_strip_provider_headers.py
 COPY patch_expose_cost_headers.py /app/code/patch_expose_cost_headers.py
 RUN python3 /app/code/patch_expose_cost_headers.py
 
+# Member access to config-declared pass-through routes: LiteLLM gates auth=true
+# pass-through endpoints behind `allowed_passthrough_routes`, an Enterprise-only
+# field that cannot be set on this community-edition proxy. This patch lets any
+# authenticated key call routes the operator lists in
+# general_settings.coop_passthrough_open_to_keys (unauthenticated access is
+# unaffected — still rejected). Non-fatal; check the "[coop-patch] applied" line
+# in the build log on every LiteLLM upgrade.
+COPY patch_passthrough_key_access.py /app/code/patch_passthrough_key_access.py
+RUN python3 /app/code/patch_passthrough_key_access.py
+
 # Audio keep-alive: scheduled pings keep the Tinfoil TEE audio enclave
 # warm so voice mode skips the ~24s cold-start (see audio_keepalive.py header).
 COPY audio_keepalive.py /app/code/audio_keepalive.py