feat: complete commercial control plane, billing, auth, and model catalog

- add PostgreSQL control-plane persistence with Redis-degraded hot reload
- implement prepaid balance, usage ledger, Stripe top-up and reconciliation
- add registration, email verification, password reset, invitations and RBAC
- support TOTP, Passkey MFA, device sessions, quotas and rate limits
- add tenant billing profiles, audit logs and operational readiness checks
- build authenticated admin console, Quickstart, Playground and usage analytics
- add public model catalog with pricing, filtering and cost estimation
- support OpenAI Responses providers and provider health failover
- validate real upstream usage reporting and balance settlement

1 files changed, 9 insertions, 2 deletions

diff --git a/cmd/aigw/main.go b/cmd/aigw/main.go
index 108a849..3ac388a 100644
--- a/cmd/aigw/main.go
+++ b/cmd/aigw/main.go
@@ -23,6 +23,7 @@ import (
 	"aigw/internal/mailer"
 	"aigw/internal/operations"
 	"aigw/internal/provider"
+	"aigw/internal/providerhealth"
 	"aigw/internal/routing"
 	"aigw/internal/telemetry"
 
@@ -178,12 +179,13 @@ func run(ctx context.Context, cfg config.Config, logger *slog.Logger) error {
 	if billingService != nil {
 		billingMeter = billingService
 	}
+	routeHealth := providerhealth.New(providerhealth.Options{})
 
 	inferenceAPI := httpapi.New(httpapi.Options{
 		Authenticator:    authenticator,
 		Catalog:          modelCatalog,
-		Router:           routing.New(modelCatalog),
-		Forwarder:        provider.New(cfg.UpstreamHTTP, metrics),
+		Router:           routing.New(modelCatalog, routeHealth),
+		Forwarder:        provider.New(cfg.UpstreamHTTP, metrics, routeHealth),
 		UsageSink:        usageSink,
 		BillingMeter:     billingMeter,
 		Limiter:          requestLimiter,
@@ -193,6 +195,7 @@ func run(ctx context.Context, cfg config.Config, logger *slog.Logger) error {
 		MaxBodyBytes:     cfg.Server.MaxBodyBytes,
 		ExposeMetrics:    cfg.Observability.ExposeMetrics,
 		DeploymentRegion: cfg.Server.DeploymentRegion,
+		BrowserOrigin:    cfg.Admin.PublicURL,
 	})
 	adminHandler := http.Handler(nil)
 	if cfg.Admin.Enabled {
@@ -201,6 +204,10 @@ func run(ctx context.Context, cfg config.Config, logger *slog.Logger) error {
 			Logger: logger, Prefix: cfg.Admin.BasePath, RegistrationEnabled: cfg.Admin.RegistrationEnabled,
 			SessionTTL: time.Duration(cfg.Admin.SessionTTLHours) * time.Hour, Currency: cfg.Billing.Currency,
 			PublicURL: cfg.Admin.PublicURL, WebAuthn: webAuthn, MailEnabled: cfg.Admin.Mail.Enabled,
+			InferencePublicURL:      cfg.Admin.InferencePublicURL,
+			DefaultLowBalanceMicros: cfg.Admin.Mail.LowBalanceMicros,
+			Catalog:                 modelCatalog,
+			ProviderHealth:          routeHealth,
 		}).Handler()
 	}
 	operationHandler := operations.Handler{Store: store, Manager: manager, Billing: billingService, Metrics: metrics,