mcp-config: add covert-gpt provider, auto-discover models

Two changes to the synced opencode config:

- Model provider. opencode can't list models from a custom OpenAI-compatible
  provider itself, so sync.sh queries the gateway's /v1/models with the
  user's key and materializes the map client-side. New gateway models land
  on every box at the next sync with no config edit. If discovery fails the
  previous map is carried over, so a gateway hiccup never empties the list.
- Aggregate MCP endpoint. One entry at /mcp/ (trailing slash required — the
  bare path 307-redirects and MCP clients don't follow it) exposes every
  server the key can access, replacing the per-server gitea entry.

sync.sh also exports OPENCODE_CONFIG: opencode does not auto-load extra
files from its config dir, so without it the synced file was ignored.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mcp-config/README.md

@@ -10,18 +10,33 @@ sync — the laptops pull from Gitea's `main`.)
 
 ## How it works
 
-- `opencode.gateway.json` — the shared server list. **Identical for every
-  user**: the per-user key is injected via `{env:LITELLM_KEY}`, never written
-  into the file. Add a gateway server here and everyone picks it up next shell.
-- `sync.sh` — sourced from each user's shell rc. On a new shell it pulls
-  `opencode.gateway.json` (throttled ~1h), drops it where opencode merges it,
-  and exports `LITELLM_KEY` from `~/.config/mcp-sync/key`. Silent + non-fatal:
-  a Gitea hiccup never breaks the shell, last-good config stays in place.
+- `opencode.gateway.json` — the shared base config: the `covert-gpt` model
+  provider (LiteLLM's OpenAI-compatible endpoint at
+  `https://llm.covert-gpt.com/v1`, models map left empty — it is filled by
+  discovery at sync time) and a single MCP entry for the gateway's
+  **aggregate** endpoint `https://llm.covert-gpt.com/mcp/` (trailing slash
+  required; the bare path 307-redirects, which MCP clients don't follow).
+  That one endpoint exposes every MCP server the user's key can access, so
+  new gateway servers need no client config change at all. **Identical for
+  every user**: the per-user key is injected via `{env:LITELLM_KEY}`, never
+  written into the file.
+- `sync.sh` — sourced from each user's shell rc. On a new shell (throttled
+  ~1h) it pulls the base config from Gitea, queries the gateway's
+  `/v1/models` with the user's key to **auto-discover models** (opencode
+  can't list models from a custom provider itself, so the map is
+  materialized client-side; if discovery fails the previous map is carried
+  over), deploys the result to `~/.config/opencode/opencode.gateway.json`,
+  and exports `LITELLM_KEY` (from `~/.config/mcp-sync/key`) plus
+  `OPENCODE_CONFIG` (pointing at the deployed file — opencode does NOT
+  auto-load extra files in its config dir, so without this export the file
+  is ignored). Silent + non-fatal: a Gitea hiccup never breaks the shell,
+  last-good config stays in place.
 - `install.sh` — one-time bootstrap (curl-pipe). Fetches `sync.sh`, stores the
   user's key (0600), and adds the rc hook.
 
-opencode **merges** config files, so the synced `opencode.gateway.json`
-coexists with each user's own `~/.config/opencode/opencode.json` and any
+opencode merges the `OPENCODE_CONFIG` file on top of the user's global
+`~/.config/opencode/opencode.json` (and under any project `opencode.json`),
+so the synced config coexists with each user's own settings and any
 **local-only** MCP servers (e.g. a client-side `kubernetes` pointed at their
 own kubeconfig). Sync never touches those.
 
@@ -37,13 +52,15 @@ curl -fsSL https://git.nic-oconnor.com/public/dotfiles/raw/branch/main/mcp-confi
 
 Open a new terminal, run `opencode`, and the gateway tools are there.
 
-## Adding a gateway server (admin)
+## Adding a gateway server or model (admin)
 
-1. Register it on the gateway (`charts/inference/values.yaml` →
-   `proxy_config.mcp_servers`), deploy, smoke-test.
-2. Add a matching entry to `opencode.gateway.json` here and push to `main`.
-3. Users get it automatically within the sync TTL (or immediately on a new
-   shell). No per-user action.
+Register it on the gateway (`charts/inference/values.yaml` →
+`proxy_config.mcp_servers` for MCP servers, `model_list` for models),
+deploy, smoke-test. That's it — clients auto-discover both: MCP servers
+through the aggregate `/mcp/` endpoint, models via the `/v1/models` query
+in `sync.sh`. Users pick them up within the sync TTL (or immediately on a
+new shell). `opencode.gateway.json` here only needs editing for structural
+changes (a new provider, endpoint URLs).
 
 For **per-user / per-target** tools (cluster access, etc.) do NOT add them
 here — those run client-side with the user's own credentials. See