v0.14.0: organizations and teams, signed releases

KTMS 0.14.0 is the last release before 1.0. It adds organizations and teams, and it is the first release published through the new compatibility gate and with signed artifacts.

Upgrading from 0.13.x: deployments that never set USAGE_PROJECT_ID now report usage under ktms instead of llm-proxy; set it to keep the old name. ktms-admin 0.4.0 pairs with this release.

Verify the images and checksums.txt as described in SECURITY.md (use V=v0.14.0).

Added

• Organizations and teams: team keys share a model allowlist and a monthly budget enforced
  by the gateway (CreateOrganization, CreateTeam, UpdateTeam, GetTeamSpend, ...).
  ListModels lists only the models a team may call.
• Operations: backups and the keyring, and a safe key rotation procedure, tested against
  Postgres; CI now runs the Postgres-backed tests (they used to skip).
• An upgrade test on every pull request and before each release: the previous release and the
  oldest release of the same major write a database, this build must keep and serve it, and the
  old release must still serve on the migrated database (rolling upgrades).
• Releases are gated: binaries and images are published only after the proto and upgrade checks
  against the previous release pass, and images only after the binaries.
• Signed releases: images and checksums.txt are signed with keyless cosign; images carry an
  SBOM and SLSA provenance, archives an SPDX SBOM. See SECURITY.md, Verifying a Release.
• govulncheck for linux and darwin on every pull request and before every release.
• The public API for 1.x is defined in the README (API stability),
  with experimental elements marked Experimental: in the proto.
• A startup warning when the deprecated LLMPROXY_ENCRYPTION_KEYS is used instead of
  KTMS_ENCRYPTION_KEYS.

Changed

• USAGE_PROJECT_ID now defaults to ktms, as the README already documented (it was
  llm-proxy). Set it explicitly to keep usage under the old project name; while it is unset
  and usage reporting is on, the gateway logs this at startup.
• Logs carry service=ktms instead of service=llm-proxy.
• The ffmpeg_missing message names the coyl/ktms:audio image.
• CI also checks usage.v1 for breaking changes. Adding the buf skip breaking label re-runs the check.
• A cache hit refused by the rpm limit returns the documented throttled:rpm reason instead of
  resource_exhausted: rpm limit exceeded.
• SENTRY_ENVIRONMENT defaults to development, as documented; it was sent empty.
• Postgres outages return the reasons auth_unavailable and storage_unavailable (were
  auth backend unavailable and storage unavailable), so the HTTP API puts them in code.
• DrainNode without node support returns FAILED_PRECONDITION instead of UNAVAILABLE.
• Docker images are built only for v* release tags (any tag used to produce images), and
  latest, slim and audio follow only the newest stable release.

Fixed

• RotateEncryption also re-encrypts the auth tokens of registered nodes, so dropping the old
  key version no longer breaks calls to nodes, and it locks the vendor key rows, so a key set
  during a rotation is no longer overwritten with the previous one.
• A vendor key the replica's keyring cannot read no longer stops that replica from loading
  config: it keeps the credential it had (or skips the key), logs and counts it. A keyring that
  reads no vendor key at all still refuses to start. RotateEncryption over such a key fails
  with FAILED_PRECONDITION instead of UNAVAILABLE storage_unavailable.
• With AUTO_SEED, starting a replica no longer rewrites unchanged seeded vendor keys, or keys
  a newer keyring already rotated, which broke rotations.

Deprecated

• LLMPROXY_ENCRYPTION_KEYS: use KTMS_ENCRYPTION_KEYS. It is removed in 2.0.
• X-LLM-Proxy-* headers: use X-KTMS-*. They are removed on their announced Sunset date,
  2027-03-01, the one removal inside 1.x.