feat(providers): advertise free-tier capability in provider plugin manifest

[maxmad64bis]

⚠️ base-red inherited: #12732

Summary

Sidecars and dashboards can now filter free-capable providers straight from the plugin manifest. A provider with documented free models carries a free-tier tag next to its existing capabilities (usage-fetch, usage-supported, ...), so consumers don't need to read the quota catalog. It's display metadata only — routing and quota logic are untouched.

The tag is derived live from the free-model catalog (77 providers at this writing) and only lights up for providers the registry actually serves (76 — one catalog entry, arcee-ai, has no registry entry yet). A STRICT docs gate fails CI if the manifest count ever drifts from the catalog.

Related Issues

• Related to feat(catalog): eligibility-gated free-tier bucket #12669 (catalog eligibility gating — this reads the same source)
• Related to fix(models): stop treating provider-supplied free flags as trusted without a documented free tier #12744 (same "documented free tier" source on the decision side — this PR is the display side)

Validation

• Change type: provider
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/free-tier-providers.test.ts (new) — leaf set derivation: known free provider, alias contract, non-string rejection, pollinations despite discontinued rows, unknown id excluded (5/5 pass)
• tests/unit/provider-plugin-manifest.test.ts (extended) — 5 new emission cases, all pass (5/5): id branch, alias-only branch (legacy-free/api-airforce), unknown id omitted, pollinations, capabilities stay sorted (whole file 15/15 with the 10 pre-existing cases)
• tests/unit/check-docs-counts-sync.test.ts (extended) — gate form pins + buildChecks() contains a free-tier check; node scripts/check/check-docs-counts-sync.mjs shows manifest 76 vs leaf∩registry 76 (leaf 77) green

Coverage Notes

• Changes open-sse/config/ (new leaf freeTierProviders.ts, union +1 and capabilitiesFor branch in providerPluginManifest.ts) plus the docs-sync gate script. Covered by the three test files above; leaf is a pure derivation with no branches beyond the null-guard.
• Neighbor suites pass (service-provider-plugin-manifest 4/4, manifest route 10/10). One pre-existing failure is inherited from the red base, not this branch: the "gate exits 0 on synced repo" test trips on the 169-vs-170 migrations doc drift (🔴 Release branch not green: release/v3.8.51 #12732).

Reviewer Notes

• One judgment call worth flagging: the gate compares the manifest count against the catalog∩registry intersection (76), not the raw catalog size (77), because arcee-ai is cataloged but has no registry entry yet. The raw size is logged in the gate detail line so the gap stays visible. If arcee-ai gets registered, both numbers move together and the gate stays green.
• No migrations, no flags, no routing changes. Single commit.
• Known asymmetry: hasFreeTierProvider matches exact ids only (no resolveProviderId — open-sse can't import from src/), unlike providerHasFreeModels which resolves aliases. An alias not declared in the entry's alias field is missed on the manifest side; callers must pass both id and alias (as capabilitiesFor does).