gateway: stop forwarding provider response headers to callers

LiteLLM copies every upstream response header onto its own response prefixed
'llm_provider-'. For our providers that hands callers operational detail about the
co-op's own account — verified live: llm_provider-x-credits-remaining carried the
remaining provider balance in every member's response.

Build-time patch makes _get_llm_provider_headers() return {}. The four OpenAI-style
x-ratelimit-* headers a provider may send are still forwarded: those describe the
caller's own request, not the co-op's account.

Dockerfile

@@ -54,6 +54,14 @@ RUN python3 /app/code/patch_audio_request_cost.py
 COPY patch_audio_router_pricing.py /app/code/patch_audio_router_pricing.py
 RUN python3 /app/code/patch_audio_router_pricing.py
 
+# SECURITY (2026-10-27, member-disclosure finding 4): LiteLLM forwards every
+# provider response header to callers as `llm_provider-*`, which leaked the
+# co-op's remaining provider balance (x-credits-remaining) to any member API key.
+# Verify the "[coop-patch] applied: provider response headers" line in the build
+# output on every version bump — the patch is non-fatal by design.
+COPY patch_strip_provider_headers.py /app/code/patch_strip_provider_headers.py
+RUN python3 /app/code/patch_strip_provider_headers.py
+
 # Audio keep-alive: scheduled pings keep the Tinfoil TEE audio enclave
 # warm so voice mode skips the ~24s cold-start (see audio_keepalive.py header).
 COPY audio_keepalive.py /app/code/audio_keepalive.py