Configures the organization's own LLM provider (bring-your-own gateway). Validates the configuration against the customer gateway and stores the credential encrypted; the credential is never returned. tierModels names one of the organization's own models per tier (high, medium, low); each feature is mapped to a tier, and an enabled gateway must name a model for all three. enabledModels may be empty, which registers the connection with no models yet; such a gateway must be created with enabled: false and stays unable to be enabled until it has models and all three tiers.