[agent-network] Document the provider save-time check

Saving a provider now asks the vendor whether its url and credential work, and
refuses the record if they do not. That changes what the Connect a Provider
steps promise, so step 6 says so and a new subsection covers the rest: which of
the two fields a refusal names, that an edit is only re-checked when the url or
the key moves, that a url-only change is tested against the stored credential,
and that a rejected key never replaces a working one.

The list of what is not checked is the part worth getting right — an operator
whose provider saved without a word should be able to see why. It covers the
providers that publish no listing, a Bedrock record pointed somewhere AWS does
not own, and any upstream on a private address, which the agents reach through
the tunnel and the management service cannot reach at all.

src/pages/agent-network/providers.mdx

@@ -59,12 +59,56 @@ and budgets (see [How It Works](/agent-network/how-it-works#llm-apis-and-ai-gate
    the vendor's own list — see [Load Models from the Provider](#load-models-from-the-provider).
 5. _(Optional, gateways)_ Fill any gateway-specific fields (for example a Portkey config
    ID) and the identity headers used for attribution.
-6. Save the provider.
+6. Save the provider. NetBird checks the upstream URL and the credential against the
+   vendor before storing them — see [The Save-Time Check](#the-save-time-check).
 
 <p>
     <img src="/docs-static/img/agent-network/providers/agent-network-create-provider.png" alt="agent network connect provider modal" className="imagewrapper" />
 </p>
 
+### The Save-Time Check
+
+Before storing a provider, NetBird asks the vendor whether the upstream URL and the
+credential work, using the same model listing that
+[Load models from provider](#load-models-from-the-provider) uses. A record that cannot reach
+its vendor is refused at the form, rather than saving cleanly and surfacing later as a
+refused request or an empty model list with nothing tying it back to the record.
+
+If the vendor refuses, the provider is not saved. The form stays open with what you typed
+still in it, and the message names which of the two is at fault: the credential was
+rejected, or the upstream URL could not be reached or does not answer a model listing. Fix
+the field it names and save again.
+
+On an existing provider, the check runs only when you change the **Upstream URL** or the
+**API key** — renaming a provider, editing model rows or changing prices saves without
+asking the vendor anything. Two consequences worth knowing:
+
+- **Changing only the URL tests it against the stored credential.** The key never returns to
+  your browser, so there is nothing else it could be tested with.
+- **A rejected key never replaces a working one.** If you paste a new key and the vendor
+  refuses it, the provider keeps running on the old one.
+
+**Which providers are checked.** The same four that can list their models: **OpenAI**,
+**Anthropic**, **Amazon Bedrock** and **Google Vertex AI**. Everything else saves without a
+check, because there is no listing to ask for or no way to reach it:
+
+- Azure OpenAI, Mistral, Kimi, the AI gateways and custom endpoints, which publish no
+  listing NetBird can ask for.
+- A Bedrock provider pointed at a proxy or a self-hosted endpoint rather than an AWS runtime
+  host, because the control plane that serves the listing is derived from that URL and
+  cannot be worked out from an address AWS does not own.
+- Any upstream on a private address. Your agents reach it through the tunnel, but NetBird's
+  management service has no route to it, so there is nothing it can ask.
+
+An unchecked provider is not a lesser one; NetBird simply has no way to verify it up front,
+so it saves what you entered.
+
+<Note>
+A vendor outage also fails the save — the check cannot confirm the provider either way, and
+saving something unverified is what it exists to prevent. If the message says the provider
+returned an error rather than naming your URL or credential, wait and save again.
+</Note>
+
 ## Custom & Self-hosted Providers
 
 Pick **Custom / Self-hosted** for any OpenAI-compatible endpoint that isn't a first-party