Add LLM agent fallback for unmapped tracker patterns

When both pattern matching and domain matching fail to identify a
tracker, an opt-in LLM agent can now attempt identification using
internal database searches and optional web search. The agent returns
structured output (third party name, category, description, confidence)
and the worker auto-creates CommonThirdParty records when needed.

The feature is gated behind the `llm.tracker-mapping.provider` config
field; when unset the worker behaves exactly as before.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/probod/probod.go

@@ -304,6 +304,11 @@ func (impl *Implm) Run(
 		return err
 	}
 
+	trackerMappingCfg, err := impl.buildTrackerMappingConfig(l, tp, r)
+	if err != nil {
+		return err
+	}
+
 	fileManagerService := filemanager.NewService(s3Client)
 
 	var samlCert *x509.Certificate
@@ -683,7 +688,7 @@ func (impl *Implm) Run(
 		},
 	)
 
-	trackerMappingWorker := cookiebanner.NewTrackerMappingWorker(pgClient, l)
+	trackerMappingWorker := cookiebanner.NewTrackerMappingWorker(pgClient, l, trackerMappingCfg)
 	trackerMappingWorkerCtx, stopTrackerMappingWorker := context.WithCancel(context.Background())
 	wg.Go(
 		func() {

pkg/probod/tracker_mapping.go

@@ -0,0 +1,52 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probod
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"go.gearno.de/kit/log"
+	"go.opentelemetry.io/otel/trace"
+	"go.probo.inc/probo/pkg/cookiebanner"
+)
+
+// buildTrackerMappingConfig wires the tracker-mapping agent. It is opt-in:
+// deployments that do not set `llm.tracker-mapping.provider` get a zero
+// config (nil LLM client) so the worker runs without agent fallback.
+func (impl *Implm) buildTrackerMappingConfig(
+	l *log.Logger,
+	tp trace.TracerProvider,
+	r prometheus.Registerer,
+) (cookiebanner.TrackerMappingConfig, error) {
+	if impl.cfg.Agents.TrackerMapping.Provider == "" {
+		return cookiebanner.TrackerMappingConfig{}, nil
+	}
+
+	agentCfg, llmClient, err := impl.resolveAgentClient(
+		"tracker-mapping",
+		impl.cfg.Agents.TrackerMapping,
+		l,
+		tp,
+		r,
+	)
+	if err != nil {
+		return cookiebanner.TrackerMappingConfig{}, err
+	}
+
+	return cookiebanner.TrackerMappingConfig{
+		LLMClient:      llmClient,
+		Model:          agentCfg.ModelName,
+		SearchEndpoint: impl.cfg.SearchEndpoint,
+	}, nil
+}