feat: upgrade LiteLLM to 1.101.0 with TypeSafe pass-through

[srinivas-jay]

The gateway's pinned LiteLLM 1.99.0 cannot serve native TypeSafe requests. This upgrades the stable dependency to 1.101.0 and backports upstream #41607 and #41723, which landed after that release. Applications can call /typesafe/v1/systemone with their gateway key; the proxy injects its TypeSafe provider key, preserves typed responses, and records model-version usage and cost.

The backport is source-checked, idempotent, and rejects partial or changed installations. Existing SSE aggregation, reasoning-effort and Hugging Face patch anchors are updated for 1.101.0. PR CI now builds both AMD64 and ARM64 without publishing.

Verification

• Local Linux ARM64 Docker build passed, including all 48 regression tests, Prisma client generation, and installed-package contracts for ChatGPT/Gemini streaming, Claude OAuth credential isolation and Hugging Face routing.
• TypeSafe contract passed with networking disabled: missing/invalid credentials rejected through the real auth dependency, five HTTP methods, request/query/base-path preservation, model discovery, upstream 429 propagation, provider-only credentials, versioned token/cost accounting. Provider HTTP and the unknown-key identity lookup are test doubles; no live provider call was made.
• Isolated PostgreSQL 17: clean install applied 165 migrations; upgrade from the deployed 1.97.0 image applied 20 additional migrations (145 → 165). Synthetic users, teams, virtual keys, permissions, budgets and spend records survived unchanged. Generated client queries and full gateway startup/readiness passed. This database check used the same dependency image before the TypeSafe-only backport, which does not change the schema. Partitioned spend logs were not tested.
• Independent review: no actionable findings; all 48 tests also passed in the image with networking disabled.

Visual evidence

Chrome capture of the actual offline contract output and asserted synthetic request/response. This is gateway verification, not a live Jev inference or an application UI.

Rollout

This PR does not deploy or modify Core Infra. Before rollout, back up the gateway database, complete live-provider canaries, inject TYPESAFE_API_KEY through Core Infra's secret handling, and deploy the resulting signed image by digest. The running gateway is still 1.97.0. Remove the temporary TypeSafe backport once an upstream stable release includes both changes and passes the contracts.