side-track: livepeer-python-gateway — per-model RemotePaymentState + model_id attribution

## Summary

**Side-track** (non-blocking for clearinghouse deliverables). Completes the gateway half of the model-ID usage-attribution work originally scoped in #41.

Clearinghouse already maps `model_id` into CloudEvent dims. Full end-to-end threat-model closure still needs:

1. **go-livepeer** — emit `model_id` on `create_signed_ticket` — [livepeer/go-livepeer#3947](https://github.com/livepeer/go-livepeer/pull/3947) (under review; kept non-blocking per Mehrdad)
2. **livepeer-python-gateway** — sign `RemotePaymentState` per-model / send real capability + `model_id` so usage cannot be misattributed to a cheaper-advertised model — see [livepeer/livepeer-python-gateway#33](https://github.com/livepeer/livepeer-python-gateway/pull/33)

## Why side-track

Upstream go-livepeer + gateway changes should not block the clearinghouse project. Track here so the relationship stays visible on the milestone without gating D2.

## Acceptance

- Gateway signs / pays with the real capability + `model_id`
- Ticket signed for model A cannot be attributed to model B once go-livepeer#3947 lands
- Peer review validates the threat model (Linear: ENG-148)

## Related

- Parent (closed, clearinghouse slice done): #41
- go-livepeer: https://github.com/livepeer/go-livepeer/pull/3947
- Gateway PR: https://github.com/livepeer/livepeer-python-gateway/pull/33

Start by reviewing the gateway PR #33 and go-livepeer PR #3947, then trace RemotePaymentState and create_signed_ticket as described in the issue. Confirm that the gateway uses the real capability and model_id, and that the threat-model review validates attribution cannot switch between models.

Written by the indexing model from the issue text.