[agent-network] Document loading a provider's models from the vendor

Providers gained a "Load models from provider" button that asks the vendor
which models the stored credential can actually reach, and fills the Models
tab with editable rows priced from the table the proxy bills with.

The Models and Pricing section covered only the manual paths — pick from the
catalog, or type an id NetBird does not know. Neither explains where the live
list comes from, and the parts an operator can be caught out by are not
guessable from the UI: gateways have no listing endpoint at all; a model
NetBird cannot price arrives at $0 and is tracked at zero until rates are set;
editing a saved provider reuses the stored key rather than anything on screen;
Bedrock ids keep their region prefix because that is the only invocable form;
and Vertex lists what the publisher offers rather than what a project enabled.

Also notes that the vendor call is made by management with the provider's
credential — not from the browser, not over an agent's tunnel — since that is
a reasonable thing to want to know before handing over a key.

The API reference for the new endpoint is generated from the OpenAPI spec on
netbirdio/netbird@main, so it lands with the next `npm run gen` after the
backend merges and is deliberately not hand-written here.

src/pages/agent-network/providers.mdx

@@ -55,7 +55,8 @@ and budgets (see [How It Works](/agent-network/how-it-works#llm-apis-and-ai-gate
 3. Paste the provider's **API key**. It is stored encrypted server-side and never sent to
    callers.
 4. _(Optional)_ Restrict the **allowed models** and set **per-model pricing** used for cost
-   estimates in usage and logs.
+   estimates in usage and logs. On supported providers, **Load models from provider** fills
+   this in from the vendor — see [Load Models from the Provider](#load-models-from-the-provider).
 5. _(Optional, gateways)_ Fill any gateway-specific fields (for example a Portkey config
    ID) and the identity headers used for attribution.
 6. Save the provider.
@@ -136,6 +137,47 @@ Self-hosters can seed the catalog defaults these fields prefill from with a
 pricing file. See
 [`server.agentNetwork.pricingDefaultsFile`](/selfhosted/maintenance/configuration-files#agent-network-settings).
 
+### Load Models from the Provider
+
+NetBird ships a catalog of known models, but it can't see your account: which OpenAI models
+your organization is entitled to, which Bedrock inference profiles exist in your account and
+region, or which Vertex AI models your project has enabled. The catalog also drifts as
+vendors retire models.
+
+On the **Models** tab, **Load models from provider** asks the vendor which models your own
+credential can actually reach and turns the answer into editable rows, each pre-filled with
+the price NetBird would bill it at.
+
+Available for **OpenAI**, **Anthropic**, **Amazon Bedrock** and **Google Vertex AI**. AI
+gateways expose no comparable listing endpoint, so the button reports that and the catalog
+list is used instead.
+
+A few details worth knowing:
+
+- **Models already on the form are left alone.** A rate you set deliberately is not
+  overwritten by a reload.
+- **Models NetBird can't price arrive at $0** and are highlighted, rather than being hidden.
+  The vendor says your credential can reach them, so leaving them out would hide models you
+  really have. Saving with any of them prompts for confirmation — usage against a $0 model is
+  tracked at zero and doesn't count toward [budget limits](/agent-network/policies/limits).
+- **Editing a saved provider reuses the stored key.** The API key never returns to your
+  browser, so the refresh runs against the credential already on the record. Change the
+  provider, or type a replacement key over the masked one, and the values on screen are used
+  instead.
+- **Bedrock ids are registered exactly as AWS issues them**, region prefix included
+  (`eu.anthropic.claude-sonnet-5-20260514-v1:0`), because that is the only form that works at
+  invoke time. Only `ACTIVE` inference profiles are offered. The listing comes from the
+  Bedrock control plane, which is a different host from the runtime endpoint you configured —
+  NetBird derives it from your upstream URL.
+- **Vertex AI lists what the publisher offers**, not what your project has enabled, so treat
+  it as a suggestion alongside the catalog rather than a definitive list.
+
+<Note>
+The vendor call is made by NetBird's management service using the provider's credential, not
+from your browser and not over your agents' tunnels. It only ever dials public vendor
+endpoints and does not follow redirects.
+</Note>
+
 ### Adding a Model Not in the Catalog
 
 If the model you need isn't in the picker, type its model ID directly into the **Model** field