Six commits supporting a follow-up bitrouter-cloud audit-fix PR. All semver-affecting changes are in this PR so cloud's dep bump can land cleanly after the next release.

What's in here

• fix(pricing): return Option when a required rate is missing (dedf41c)
  bitrouter_core::pricing::calculate_cost and the bitrouter_api::mpp::calculate_usage_cost wrapper now return Option<f64>. The previous unwrap_or(0.0) short-circuit silently undercharged whenever a token bucket had nonzero usage but no rate (a provider with input pricing and output_tokens: {} placeholder, for instance, billed every output token at $0). The four /v1/chat/completions-shaped filter sites log pricing_unavailable and skip the deduct when None comes back — the recommender's skip-incomplete change on the cloud side is what should keep that from happening in practice.

• feat(pricing): add ModelPricing::is_complete and reserved output buckets (95b64cf)
  ModelPricing::is_complete() is the "safe to bill" predicate the cheapest-picker / recommender call to refuse placeholder entries. Adds reserved OutputTokenPricing.image / .audio fields (serde-round-tripped) so multimodal billing has a place to land without another breaking change.

• feat(billing): explicit BillingMode on RoutingTarget (1b68281)
  The filters previously inferred "is this a BYOK request?" from target.api_key_override.is_some(). Cloud-routed targets always carry a platform key, so that inference treated every cloud request as BYOK and the deduct gate was unconditionally skipped. New BillingMode { Cloud, Byok } field on RoutingTarget; defaults to Cloud so a forgotten field bills (safer than silently leaking). All four filters now read this field. All in-tree RoutingTarget constructors get an explicit billing_mode: BillingMode::default().

• feat(billing): deduct returns DebitOutcome (Settled | Deferred) (65efb60)
  Extends the PaymentGate::deduct contract. Deferred lets a gate signal "couldn't draw right now but recorded the debt for later collection" — callers MUST treat it as success, the response goes back unchanged. The credits-backed cloud gate uses this to insert a pending_debits row instead of failing the response. MppState's impl maps its existing success path to Settled (channels can't defer).

• feat(mpp): export DebitOutcome from the public mpp module (01ee02c)
  One-liner to make the new enum reachable from downstream cloud crates.

• fix(stream): bill estimated output on mid-stream client disconnect (720bd77)
  StreamObservation::outcome used to return Err whenever the client disconnected mid-stream, routing to on_request_failure with no billing — an attacker who drained a long generation and hung up before the Finish event paid nothing. Now: when Finish landed first, settle with its authoritative usage even if disconnect happened after; when disconnect beats Finish, return a synthesized usage with output tokens estimated from delta.len() / 4 so the request bills something. Input billing on disconnect is a known gap (prompt not plumbed through StreamObservation).

Compat notes

Three of these are technically API-breaking and want a minor bump:

• RoutingTarget gains a billing_mode field — any downstream literal constructor needs to add it. Cushioned by BillingMode::default() returning Cloud.
• calculate_cost / calculate_usage_cost now return Option<f64> — callers must handle None. Only known consumer is bitrouter-cloud.
• PaymentGate::deduct returns Result<DebitOutcome, _> — trait impls update.

bitrouter-observe::ModelSpendObserver is updated in-tree to keep working with the new Option return (logs pricing_unavailable, writes cost=0 to the spend log rather than crashing).

Test plan

• cargo nextest run — 968/968 pass
• cargo clippy --all-targets -- -D warnings — clean
• cargo fmt -- --check — clean
• New unit tests in bitrouter-core::pricing::tests (Option / partial pricing / unused-bucket cases)
• New unit tests in bitrouter-api::router::stream_observation_tests (disconnect after Finish, disconnect with deltas, disconnect with no output)
• Integration / staging snapshot — paired with the bitrouter-cloud follow-up PR before either lands in production

🤖 Generated with Claude Code