[Chris Trevino (darthtrevino)]

Summary

Add explicit provider-managed authentication to GraphRAG’s existing LiteLLM completion and embedding implementations. This enables providers such as github_copilot without dummy API keys, custom adapters, or Azure managed identity workarounds.

Changes

• Add auth_method: provider, leaving login, credential caching, token refresh, and transport to LiteLLM.
• Omit GraphRAG credentials and reject conflicting authentication overrides.
• Preserve existing API-key and Azure-managed-identity behavior.
• Preserve token/request metrics when provider pricing metadata is unavailable; warn and omit unavailable costs rather than reporting zero.
• Normalize missing/null embedding response model identifiers using the requested model while preserving model identifiers returned by the provider.
• Document Copilot configuration and interactive authentication, with a link to upstream LiteLLM documentation.
• Keep the existing LiteLLM dependency and lockfile unchanged.

Validation

• 134 configuration and language-model tests passed.
• Repository-wide formatting, lint, and type checks passed.
• Live chat through GraphRAG → LiteLLM → Copilot succeeded: gpt-4o returned OK, using 13 total tokens.
• Live embeddings through the same path succeeded: text-embedding-3-small returned one 1,536-dimensional vector, using 2 total tokens.
• Normal GraphRAG metrics recorded successful requests for both.

Downstream follow-up

BenchmarkQED can adopt provider-managed authentication after a GraphRAG release containing these changes. That downstream release dependency does not block this PR.

Live probes covered basic chat and embeddings, not structured-output quality or all account/model combinations.