fix: avoid charging request-time quota hit

[PatilHrushikesh]

Description

Fixes token quota accounting for request-time rate-limit checks.

Previously, QuotaPolicy request-time rate-limit entries omitted hits_addend. Envoy Rate Limit Service treats an omitted value as an increment of 1, so a completed request with total_tokens = 28 charged 1 at request time and 28 again when the response completed, resulting in 29 tokens deducted.

This change:

• Sets an explicit request-time hits_addend of 0 in buildSimpleModelEntries.
• Sets the same explicit zero addend for bucket-rule and default-bucket entries in buildBucketRuleLimitEntries.
• Preserves the stream-done addend sourced from dynamic quota_cost metadata, which charges the actual token usage.
• Adds and updates tests covering simple models, bucket rules, default buckets, client selectors, and stream-done entries.

Validation

• go test -count=1 ./internal/extensionserver
• go test -count=1 ./internal/controller ./internal/extensionserver
• Linter checks passed.
• Rebuilt and deployed controller and extproc images to the k1 cluster.
• Live gateway validation confirmed total_tokens = 28, request-time hits_addend = 0, stream-done hits_addend = 28, and an RLS cache increment of exactly 28.

Special notes for reviewers

BackendTrafficPolicy is not changed by this PR. Its token-cost configuration already supports an explicit request cost of 0 and a response cost from AI Gateway dynamic metadata. Ordinary request-count BackendTrafficPolicy limits continue to use their intended request increment.

[netlify]

✅ Deploy Preview for theagentrouter canceled.

Name	Link
🔨 Latest commit	1b2e32b
🔍 Latest deploy log	https://app.netlify.com/projects/theagentrouter/deploys/6acb28942debd40008ca6631

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[AyushSawant18588]

Changes LGTM. The test failure seems due to a transient issue can it be checked and rerun?