librechat-sandbox: image gen bills to system key (no gate); fallback usage monitored in digest

maintenance/librechat-sandbox.md

@@ -49,13 +49,14 @@ summary.
 
 ## Image generation (two member-facing paths)
 
-1. **MCP tool (default, no key ever)**: the `inference-image` MCP server
-   exposes `generate_image` in the composer's **+** palette — no agent setup,
-   no key prompt. The server uses the member's `IC_API_KEY` if LibreChat
-   injected one, otherwise sends a **keyless request** (the gateway bills the
-   request; per-member billing is NOT enforced on this path).
-   `customUserVars` were removed from the live yaml on 2026-10-19 — members
-   are never asked for a key.
+1. **MCP tool (default, no key ever, no gate)**: the `inference-image` MCP
+   server exposes `generate_image` in the composer's **+** palette — no agent
+   setup, no key prompt. Images bill to the co-op SYSTEM key
+   (`SYSTEM_IMAGE_KEY`, LiteLLM alias `system-image-fallback`, $5/30d,
+   `regolo/qwen-image` only). No `customUserVars` gate — it made the credential
+   REQUIRED and blocked the whole server for any not-yet-seeded member
+   (first-login gap) before the fallback could run, and v0.8.8 has no optional
+   flag. Per-member image billing is therefore deferred.
 2. **Agent tool**: LibreChat's built-in "OpenAI Image Tools"
    (`IMAGE_GEN_OAI_BASEURL`/`IMAGE_GEN_OAI_MODEL` → gateway; members paste
    their own key — v0.8.8 limitation).