feat(manifest): add inference_headers config key

JSON object of extra HTTP headers the add-in attaches to every request
it sends to the configured gateway. Lets enterprise gateways receive
accounting or routing tags without a header-injecting proxy in front.

- build-manifest.mjs: KEYS validator entry
- manifest.md / bootstrap.md / update-user-attrs.md: documented with
  example and reserved-header list

claude-in-office/commands/bootstrap.md

@@ -175,6 +175,20 @@ uses the standard `key1=value1,key2=value2` format and interpolates like any
 other value. The collector must allow CORS from the add-in origin — see
 [above](#cors--every-url-needs-it).
 
+### `inference_headers`
+
+```json
+"inference_headers": { "x-application-id": "app123" }
+```
+
+Extra HTTP headers attached to every request the add-in sends to your gateway
+(`gateway_url`) — typically accounting tags the gateway uses for cost
+allocation. Applies only to gateway deployments; direct cloud connections
+ignore it. The add-in treats them as opaque pass-through; `Authorization`,
+`x-api-key`,
+`Content-Type`, `Host`, `Content-Length`, `User-Agent`, `Cookie`, and any
+`anthropic-*` / `x-amz-*` / `x-goog-*` header are reserved and dropped.
+
 ### `mcp_servers`
 
 Array of MCP servers the add-in connects to for this user.

claude-in-office/commands/manifest.md

@@ -76,6 +76,26 @@ browser WebView). Leave it unset and no custom collector is configured.
 Setting these here applies one collector org-wide; per-user routing belongs in
 [bootstrap](bootstrap.md#telemetry) or extension attrs.
 
+## Inference headers
+
+`inference_headers` is a JSON object of extra HTTP headers the add-in attaches
+to every request it sends to your gateway (`gateway_url`). Use it for
+accounting or cost-allocation tags your gateway expects — e.g., an internal
+application ID — so you don't need a header-injecting proxy in front of it.
+Applies only when using a gateway; direct cloud connections ignore it.
+
+```bash
+inference_headers='{"x-application-id":"app123"}'
+```
+
+The add-in treats the values as opaque. `Authorization`, `x-api-key`,
+`Content-Type`, `Host`, `Content-Length`, `User-Agent`, `Cookie`, and any
+`anthropic-*` / `x-amz-*` / `x-goog-*` header are reserved and silently dropped
+— they carry the add-in's own auth and protocol negotiation.
+
+Setting it here applies one header set org-wide; per-user values belong in
+[bootstrap](bootstrap.md#inference_headers).
+
 ## Auto-connect
 
 Default: when all fields for a provider are set, users skip the connection form

claude-in-office/commands/update-user-attrs.md

@@ -20,6 +20,7 @@ over manifest params, so whatever's here wins. All values are 256 chars max.
 | `gateway_token` | Per-user API key (rotation) |
 | `gateway_url` | Route different teams to different gateways |
 | `gateway_api_format` | Gateway speaks Bedrock/Vertex pass-through, not Anthropic `/v1/messages` |
+| `inference_headers` | Per-user accounting tag for the gateway (JSON; mind the 256-char cap) |
 | `bootstrap_url` | Per-user credential-vending endpoint |
 | `gcp_project_id` | Different teams on different GCP projects |
 | `gcp_region` | Data-residency override |

claude-in-office/scripts/build-manifest.mjs

@@ -39,6 +39,7 @@ const KEYS = {
   gateway_auth_header: { pattern: /^(x-api-key|authorization)$/i, hint: "auth header scheme (default: x-api-key)" },
   gateway_api_format: { pattern: /^(anthropic|bedrock|vertex)$/i, hint: "anthropic | bedrock | vertex" },
   mcp_servers: { pattern: /^\[.*\]$/, hint: "JSON array of {url, label, headers?, discover?}" },
+  inference_headers: { pattern: /^\{.*\}$/, hint: "JSON object of extra headers to attach to every model request" },
   bootstrap_url: { pattern: /^https:\/\//, hint: "HTTPS endpoint returning per-user config" },
   otlp_endpoint: { pattern: /^https:\/\//, hint: "OTLP/HTTP traces collector URL" },
   otlp_headers: { pattern: /./, hint: "comma-separated k=v pairs for the OTLP exporter" },