[management] Point the agent-config e2e providers at the mock upstream (#7542)

TestAgentConfigAllowlistOfDeclaredModels still pointed its providers at api.openai.com and bedrock-runtime with a dummy key, so every save has been refused with "the provider rejected the credential" and the Agent Network E2E has been red on main since — both subtests, every scheduled run.

Every other suite already uses the mock vLLM upstream (harness.StartVLLM), which answers both the OpenAI (/v1/models) and the Bedrock (/inference-profiles) listing; this test does the same. What it checks — the allowlist advertising the provider's declared ids on GET /api/agent-network/agent-config — never depended on the vendor.

e2e/agentnetwork/agent_config_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/netbirdio/netbird/e2e/harness"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
@@ -65,16 +66,24 @@ func configProvider(cfg api.AgentNetworkAgentConfig, name string) *api.AgentNetw
 func TestAgentConfigAllowlistOfDeclaredModels(t *testing.T) {
 	ctx := context.Background()
 
+	// Saving a provider makes management verify the credential against the
+	// upstream, and a real vendor refuses the dummy key and the save with it.
+	// The providers point at the mock upstream instead: it resolves to a
+	// private address, which the check declines to dial and treats as
+	// unverifiable rather than as a failure, so the save goes through. The
+	// test is about the allowlist, not the upstream.
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
 	cases := []struct {
 		name      string
 		catalogID string
-		upstream  string
 		declared  string
 	}{
 		{
 			name:      "plain-declared-id",
 			catalogID: "openai_api",
-			upstream:  "https://api.openai.com",
 			declared:  "gpt-4o-mini",
 		},
 		{
@@ -83,7 +92,6 @@ func TestAgentConfigAllowlistOfDeclaredModels(t *testing.T) {
 			// picker copies it as-is.
 			name:      "bedrock-declared-id",
 			catalogID: "bedrock_api",
-			upstream:  "https://bedrock-runtime.eu-central-1.amazonaws.com",
 			declared:  "eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
 		},
 	}
@@ -101,7 +109,7 @@ func TestAgentConfigAllowlistOfDeclaredModels(t *testing.T) {
 			prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
 				Name:        providerName,
 				ProviderId:  tc.catalogID,
-				UpstreamUrl: tc.upstream,
+				UpstreamUrl: vllm.URL,
 				ApiKey:      ptr("sk-dummy-e2e-key"),
 				Enabled:     ptr(true),
 				Models:      &[]api.AgentNetworkProviderModel{{Id: tc.declared, InputPer1k: 0.001, OutputPer1k: 0.002}},