Add `encrypted_content_affinity` to config.yaml for future Responses API load balancing

[semidark]

Currently, the LiteLLM proxy configuration does not include the encrypted_content_affinity pre-call check.

For Responses API models (like gpt-5.1-codex and gpt-5.3-codex), if clients chain calls by passing previous_response_id or encrypted reasoning items, these follow-up requests must route to the same Azure deployment that generated the encryption key.

If we ever add multiple deployments per model_name (e.g., load balancing gpt-5.1-codex across both germanywestcentral and swedencentral under the exact same alias), requests will fail with invalid_encrypted_content errors unless affinity routing is enabled.

To fix this when we expand to load balancing:

router_settings:
  optional_pre_call_checks:
    - encrypted_content_affinity

Note: This is not strictly necessary right now because each model_name in openai.tf maps to a single regional deployment. We are tracking this purely for future scale-out scenarios.

[semidark]

I've analyzed this issue. The fix requires adding a router_settings block to the infra/config.yaml.tpl file.

To resolve this, the following block needs to be appended to infra/config.yaml.tpl:

# Enable affinity for encrypted reasoning to support future multi-region load balancing
router_settings:
  optional_pre_call_checks:
    - encrypted_content_affinity

Because this is a Terraform managed template, after editing the file, the changes must be deployed by running:

cd infra/
terraform plan -out=tfplan
terraform apply tfplan

Note: This is purely a tracking comment based on a read-only analysis.