gateway: let member keys reach the Metis pass-through route

LiteLLM gates auth=true pass-through routes behind allowed_passthrough_routes,
a LiteLLM Enterprise field: on this community-edition proxy the management API
refuses to set it, so no member key can ever be granted access, and auth:false
would instead expose the route (and our GreenPT key) to anonymous callers.

Add patch_passthrough_key_access.py (house style: build-time, non-fatal,
idempotent, compile-checked) so routes the operator names in
general_settings.coop_passthrough_open_to_keys are callable by ANY
authenticated key. Authentication itself is unchanged: auth=true still installs
Depends(user_api_key_auth), so unauthenticated requests are still rejected.

Validated locally against LiteLLM 1.103.2: a plain generated key gets 200 with
real Metis answers; an unauthenticated POST gets 401.

patch_passthrough_key_access.py

@@ -0,0 +1,107 @@
+"""Open explicitly-listed pass-through routes to any authenticated key.
+
+WHY. Config-declared pass-through endpoints registered with ``auth: true`` are
+gated at request time by ``allowed_passthrough_routes`` on the key or team
+(``RouteChecks.check_passthrough_route_access``). That field is a **LiteLLM
+Enterprise** feature: on a community-edition proxy the management API refuses to
+set it ("This feature is only available for LiteLLM Enterprise users"), so a
+member key can never be granted access by any supported route. The only other
+lever is ``auth: false``, which forwards **unauthenticated** requests — a public
+relay of the co-op's GreenPT key. Neither is acceptable.
+
+This patch lets the operator name such routes in the proxy config:
+
+    general_settings:
+      coop_passthrough_open_to_keys: ["/v1/systemone"]
+
+Any route listed there is allowed for any key that has already authenticated.
+Authentication itself is untouched: ``auth: true`` still installs
+``Depends(user_api_key_auth)``, so an unauthenticated request is rejected earlier
+and never reaches this function. The patch only relaxes the *second* gate
+(per-key allow-list), and only for routes the operator listed by hand.
+
+House style: run at BUILD time (the runtime rootfs is read-only under Cloudron);
+non-fatal — if upstream renames or restructures this function, WARN and exit 0;
+idempotent — detect the marker on a rebuild and skip; and compile the patched
+source in memory before writing, so a patch that cannot import never ships.
+
+Check the ``[coop-patch] applied`` line in the build log on every LiteLLM bump.
+"""
+from pathlib import Path
+import os
+import sys
+
+MARKER = "coop_passthrough_open_to_keys"
+
+# Unique multi-line anchor: the def + docstring + the first statement of the body.
+OLD = (
+    "    def check_passthrough_route_access(route: str, user_api_key_dict: UserAPIKeyAuth) -> bool:\n"
+    "        \"\"\"\n"
+    "        Check if route is a passthrough route.\n"
+    "        Supports both exact match and prefix match.\n"
+    "        \"\"\"\n"
+    "        metadata: Final = user_api_key_dict.metadata\n"
+)
+
+NEW = (
+    "    def check_passthrough_route_access(route: str, user_api_key_dict: UserAPIKeyAuth) -> bool:\n"
+    "        \"\"\"\n"
+    "        Check if route is a passthrough route.\n"
+    "        Supports both exact match and prefix match.\n"
+    "        \"\"\"\n"
+    "        # [coop-patch] Routes the operator lists in\n"
+    "        # general_settings.coop_passthrough_open_to_keys are callable by ANY\n"
+    "        # authenticated key. LiteLLM's own gate (allowed_passthrough_routes)\n"
+    "        # is Enterprise-only, so it can never be granted on this deployment.\n"
+    "        # Authentication is unaffected: auth=True on the endpoint still\n"
+    "        # requires a valid key before this function runs.\n"
+    "        try:\n"
+    "            from litellm.proxy.proxy_server import general_settings as _coop_general_settings\n"
+    "\n"
+    "            _coop_open_to_keys = (_coop_general_settings or {}).get(\"coop_passthrough_open_to_keys\") or []\n"
+    "            for _coop_route in _coop_open_to_keys:\n"
+    "                if RouteChecks._route_matches_allowed_route(route=route, allowed_route=_coop_route):\n"
+    "                    return True\n"
+    "        except Exception:\n"
+    "            pass\n"
+    "\n"
+    "        metadata: Final = user_api_key_dict.metadata\n"
+)
+
+
+def main() -> int:
+    # ROOT override (house style) lets the same script run against a pulled copy
+    # locally: COOP_PATCH_ROOT=<dir containing .venv/lib>.
+    root = Path(os.environ.get("COOP_PATCH_ROOT", "/app"))
+    candidates = sorted(
+        (root / ".venv/lib").glob("python3*/site-packages/litellm/proxy/auth/route_checks.py")
+    )
+    if not candidates:
+        print("WARN passthrough-key-access: route_checks.py not found under /app/.venv/lib — skipping")
+        return 0
+
+    target = candidates[-1]
+    src = target.read_text()
+    if MARKER in src:
+        print("passthrough-key-access: already applied")
+        return 0
+
+    found = src.count(OLD)
+    if found != 1:
+        print(f"WARN passthrough-key-access: expected exactly 1 anchor, found {found} — skipping")
+        return 0
+
+    patched = src.replace(OLD, NEW)
+    try:
+        compile(patched, str(target), "exec")
+    except SyntaxError as e:
+        print(f"WARN passthrough-key-access: patched source does not compile ({e}) — skipping")
+        return 0
+
+    target.write_text(patched)
+    print(f"[coop-patch] applied: passthrough-key-access -> {target}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())