fix(litellm): sanitize customer ID in MCP server alias

LiteLLM rejects server names containing `-`, but customer IDs are
UUIDs. Replace `-` with `_` in both the MCP server alias and key alias.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/auth/litellm.ts

@@ -20,8 +20,13 @@ interface LiteLLMMCPServerResponse {
  * so we create one MCP server entry per customer with the customer-specific
  * demux URL. The virtual key is then scoped to only that server.
  */
+/** LiteLLM rejects server names containing `-`; replace with `_`. */
+function toServerAlias(customerId: string): string {
+  return `sitebridge_${customerId.replace(/-/g, "_")}`;
+}
+
 export async function provisionMcpServer(customerId: string): Promise<string> {
-  const serverAlias = `sitebridge-${customerId}`;
+  const serverAlias = toServerAlias(customerId);
   const demuxUrl = `${config.agilitonAccountUrl}/mcp/demux/${customerId}/mcp`;
 
   const body = {
@@ -63,7 +68,7 @@ export async function provisionLiteLLMKey(customerId: string, email: string): Pr
 
   // 2. Create virtual key scoped to that MCP server
   const body = {
-    key_alias: `sb-${customerId}`,
+    key_alias: `sb_${customerId.replace(/-/g, "_")}`,
     models: config.defaultModels,
     mcp_servers: [mcpServerAlias],
     max_budget: config.defaultBudgetUsd,