Freeway: self-hosted OpenAI-compatible gateway for free-tier providers

One endpoint in front of every free LLM tier, with automatic failover and no
provider key ever leaving the box.

Providers are data, not code: adding one is a JSON file plus an env var, never
a TypeScript change. Ships 12 providers pre-written; `verify-provider --apply`
derives the live model list from your own key.

- core: registry, bucketed quota meter (rolling + UTC-calendar windows),
  key-pool store, 6-step model router with diagnostic rejection reasons
- gateway: node:http, failover that commits to a stream only after 200 headers,
  SSE passthrough with usage sniffing, virtual keys with admin/inference roles
- context engine: sqlite sessions and a 5-rung refit ladder, so a 128k thread
  keeps working when it fails over to an 8k model
- cache: exact (sha256, safe-by-default) + opt-in semantic (flat Float32Array)
- guard: inbound limits, quota forecasting, limit calibration from upstream
  headers, key health, secret/PII/injection scanning
- dashboard: one self-contained HTML file, live SSE request log, token usage
- sdk: zero-dep typed client, drop-in for the OpenAI SDK

Zero runtime dependencies. 326 tests, 27-check smoke suite against a scripted
mock upstream so routing is testable without spending quota.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

providers/groq.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "./_schema.json",
+  "id": "groq",
+  "label": "Groq",
+  "docs": "https://console.groq.com/docs/models",
+  "console": "https://console.groq.com/keys",
+  "priority": 15,
+  "baseUrl": "https://api.groq.com/openai/v1",
+  "auth": { "type": "bearer", "envKeys": ["GROQ_API_KEY", "GROQ_API_KEY_2"] },
+  "limits": { "rpm": 30, "rpd": 14400, "tpm": 6000 },
+  "limitsSource": "docs",
+  "verifiedOn": "2026-08-16",
+  "modelsEndpoint": "/models",
+  "modelsPath": "data[].id",
+  "notes": "LPU inference, very fast. Free limits vary per model — the numbers here are the commonly published floor, and the guard layer replaces them with per-key values read from x-ratelimit-* response headers. Run scripts/verify-provider.mjs groq to populate the real model list.",
+  "models": [
+    { "id": "llama-3.3-70b-versatile", "label": "Llama 3.3 70B", "alias": ["fast", "big"], "context": 131072, "caps": ["chat", "tools", "json", "long-context"], "priority": 10 },
+    { "id": "llama-3.1-8b-instant", "label": "Llama 3.1 8B Instant", "alias": ["cheap"], "context": 131072, "caps": ["chat", "tools", "json"], "priority": 20 }
+  ]
+}