Correct model loading against the merged backend and UI

The section was written before netbird#7246/#7250 and dashboard#767 merged,
and describes behaviour neither shipped.

- Loading fills the model picker; it does not write rows. Say so, and point
  at Add More, which is how a loaded model reaches the form.
- Only a model the catalog already prices arrives priced. Drop the claim
  that every loaded model is pre-filled with the rate NetBird would bill.
- "Gateways have no listing endpoint" is not the boundary: only OpenAI,
  Anthropic, Bedrock and Vertex declare one, so Azure OpenAI, Mistral, Kimi
  and custom endpoints fall back to the catalog too.
- A $0 model adds nothing to the spend cap, but its tokens still count
  toward the token cap. The old text implied it escaped limits entirely.
- The Bedrock prefix is a cross-region geography, not the configured region,
  and AWS offers the same model under several — an operator sees eu. and
  global. rows for one model and reads it as a bug. Pricing keys on the
  geography-stripped id (shared/llm/model.go), so the duplicates cost the
  same. Example id replaced with one the code attests.
- Vertex lists the Anthropic publisher's catalog specifically, and returns
  version-pinned ids.
- Credential wording made provider-neutral, naming the Vertex service
  account key, and the upstream URL added to what invalidates stored-key
  reuse. Discovery is gated on the create-provider permission.

src/pages/agent-network/providers.mdx

@@ -55,8 +55,8 @@ and budgets (see [How It Works](/agent-network/how-it-works#llm-apis-and-ai-gate
 3. Paste the provider's **API key**. It is stored encrypted server-side and never sent to
    callers.
 4. _(Optional)_ Restrict the **allowed models** and set **per-model pricing** used for cost
-   estimates in usage and logs. On supported providers, **Load models from provider** fills
+   estimates in usage and logs. On supported providers, **Load models from provider** offers
-   this in from the vendor — see [Load Models from the Provider](#load-models-from-the-provider).
+   the vendor's own list — see [Load Models from the Provider](#load-models-from-the-provider).
 5. _(Optional, gateways)_ Fill any gateway-specific fields (for example a Portkey config
    ID) and the identity headers used for attribution.
 6. Save the provider.
@@ -144,38 +144,50 @@ your organization is entitled to, which Bedrock inference profiles exist in your
 region, or which Vertex AI models your project has enabled. The catalog also drifts as
 vendors retire models.
 
-On the **Models** tab, **Load models from provider** asks the vendor which models your own
+On the **Models** tab, **Load models from provider** asks the vendor which models it offers
-credential can actually reach and turns the answer into editable rows, each pre-filled with
+this provider's credential, and adds the answer to the model picker. Nothing is written to
-the price NetBird would bill it at.
+the form on its own: the models already listed keep the rates you gave them, and you pick
+the ones you want from **Add More**.
 
-Available for **OpenAI**, **Anthropic**, **Amazon Bedrock** and **Google Vertex AI**. AI
+Available for **OpenAI**, **Anthropic**, **Amazon Bedrock** and **Google Vertex AI**. Every
-gateways expose no comparable listing endpoint, so the button reports that and the catalog
+other entry in the catalog — Azure OpenAI, Mistral, Kimi, the AI gateways and custom
-list is used instead.
+endpoints — publishes no listing NetBird can ask for, so the button reports that and the
+catalog list is used instead.
+
+For a provider you are still filling in, the button stays disabled until the **Upstream URL**
+and the credential are both filled in.
 
 A few details worth knowing:
 
-- **Models already on the form are left alone.** A rate you set deliberately is not
+- **A model the catalog already prices arrives priced.** Anything else arrives with no input
-  overwritten by a reload.
+  or output rate: NetBird outlines the row and asks you to confirm before saving it, rather
-- **Models NetBird can't price arrive at $0** and are highlighted, rather than being hidden.
+  than hiding the model — the vendor listed it, so leaving it out would hide a model you
-  The vendor says your credential can reach them, so leaving them out would hide models you
+  really have. Set the rates yourself, or usage against it is costed at $0 and adds nothing
-  really have. Saving with any of them prompts for confirmation — usage against a $0 model is
+  to the spend side of [token & budget limits](/agent-network/policies/limits). Its tokens
-  tracked at zero and doesn't count toward [budget limits](/agent-network/policies/limits).
+  still count toward the token caps.
-- **Editing a saved provider reuses the stored key.** The API key never returns to your
+- **Editing a saved provider reuses the stored credential.** The API key (or, on Vertex AI,
-  browser, so the refresh runs against the credential already on the record. Change the
+  the uploaded service account key) never returns to your browser, so the lookup runs against
-  provider, or type a replacement key over the masked one, and the values on screen are used
+  the credential already on the record. Change the provider, the upstream URL, or the masked
-  instead.
+  credential and NetBird asks for a credential to use instead — the values on screen are
-- **Bedrock ids are registered exactly as AWS issues them**, region prefix included
+  then used.
-  (`eu.anthropic.claude-sonnet-5-20260514-v1:0`), because that is the only form that works at
+- **Bedrock ids are registered exactly as AWS issues them**, prefix included
-  invoke time. Only `ACTIVE` inference profiles are offered. The listing comes from the
+  (`eu.anthropic.claude-sonnet-4-5-20250929-v1:0`), because that is the only form that works
+  at invoke time. The prefix is a cross-region geography (`us.`, `eu.`, `apac.`, `global.`,
+  and so on) rather than the region you configured, and AWS routinely offers the same model
+  under more than one — so expect both an `eu.anthropic.…` and a `global.anthropic.…` entry
+  for it. Both are genuine, and both cost the same, since pricing keys on the model and not
+  the geography. Only `ACTIVE` inference profiles are offered. The listing comes from the
   Bedrock control plane, which is a different host from the runtime endpoint you configured —
   NetBird derives it from your upstream URL.
-- **Vertex AI lists what the publisher offers**, not what your project has enabled, so treat
+- **Vertex AI lists the Anthropic publisher's catalog**, not what your project has enabled,
-  it as a suggestion alongside the catalog rather than a definitive list.
+  so treat it as a suggestion alongside NetBird's catalog rather than a definitive list. Ids
+  come back version-pinned, in the `claude-sonnet-4-5@20250929` form Vertex addresses them by.
 
 <Note>
 The vendor call is made by NetBird's management service using the provider's credential, not
 from your browser and not over your agents' tunnels. It only ever dials public vendor
-endpoints and does not follow redirects.
+endpoints and does not follow redirects. Loading the list spends that credential against the
+vendor, so it needs the same permission as creating a provider.
 </Note>
 
 ### Adding a Model Not in the Catalog
@@ -201,4 +213,3 @@ first provider and reachable only over the NetBird overlay.
 Agents send normal provider requests to the endpoint without an API key; which identities
 may reach which providers is governed by [Policies](/agent-network/policies).
 
-