fix(update): read model-page prices from a host that answers

End-to-end verification against the live site found the price capture broken for
a whole class of users: the civitai page hosts are not interchangeable, and the
user's civitai_host preference was silently fatal. With civitai_host=civitai.red
the update DB held zero prices even with tracking enabled.

- civitai.red refuses non-browser HTTP clients outright (Cloudflare challenge,
  403 for any User-Agent, aiohttp and httpx alike), while civitai.com and
  civitai.green answer normally for anonymously visible models and 404 for
  mature ones. An earlier manual check with curl passed on TLS fingerprint luck,
  which is why this was missed.
- get_model_prices now tries the configured host first, then the others, and
  takes the first parseable payload. The host that worked is remembered, and a
  host that refuses outright is parked for 15 minutes so a library full of
  mature models does not pay three requests each; a 404 is model-specific and
  does not park the host. Links keep using the configured host, which is where
  the user's own browser has clearance.
- Mature models still have no price source anywhere, so that is now stated
  instead of silent: price_check_attempted_at separates "tried and unreadable"
  from "never looked", gated versions show a muted "Price unavailable" badge,
  and the alerts panel reports unavailableCount.
- Failures are logged at warning level, once per host per TTL, with the
  per-host reason, instead of only at debug level.
- The recorded alternatives (internal tRPC with the user's API key, or an
  extension-assisted fetch from the user's browser) and the strengthened
  upstream ask for a public price field are documented in the plan.

static/js/components/shared/ModelVersionsTab.js

@@ -609,6 +609,20 @@ function renderRow(version, options) {
                 )
                 : buildPriceTooltip(version, paidBadgeLabel),
         }));
+    } else if (isGated(version) && version.priceAttemptedAt) {
+        // We looked and could not read a price. Staying silent would read as
+        // "free", which is the one thing this version is not.
+        badges.push(buildBadge(
+            translate('modals.model.versions.badges.priceUnavailable', {}, 'Price unavailable'),
+            'muted',
+            {
+                title: translate(
+                    'modals.model.versions.badges.priceUnavailableTooltip',
+                    {},
+                    'CivitAI does not publish this price in its public API, and mature model pages can only be read in a browser'
+                ),
+            }
+        ));
     }
 
     // A version that used to be gated and no longer is. `gateLapsedAt` is