Post Serving Usage

Meter + bill a serving request's tokens (per-token at Fireworks cost + 20%).

Machine-to-machine: the serving layer calls this after generating, authenticated with the internal key. Debits the org's prepaid balance and records the usage row. The serving caller reports fire-and-forget (at-most-once), so a dropped report under-meters rather than double-bills; the stable per-generation requestId keeps it idempotent if a retry is ever added (a replay with the same id returns the original charge without debiting again).

The caller may send orgId directly, or just adapterId (the serving layer's case) — we resolve the owning org from the adapter when orgId is absent.

Cross-tenant safety (mirrors the /api/sample BOLA hardening): the adapter has exactly one owning org, so whenever adapterId is present it is the AUTHORITATIVE source of the billing org. A client-supplied orgId may never override it — if both are given they must match, or we reject (a mismatch means the caller is trying to bill another tenant for this adapter's usage, or vice-versa). orgId alone is honored only when no adapterId is supplied.