### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

When multiple requests are sent through a **single shared virtual key**, each carrying a different OpenAI-style `user` field, the `end_user` column in `LiteLLM_SpendLogs` (and the per-end-user spend in `LiteLLM_EndUserTable`) is **pinned to the `user` value of the first request seen on that key**. Every later request on the same key is mis-attributed to that first end-user.

**Expected:** each spend-log row records the `user` value supplied on *that* request, so spend is attributable per end-user even when many users share one virtual key.

**Actual:** all rows show the first end-user (`alice` below), and `LiteLLM_EndUserTable` bills the entire shared key's spend to that one end-user.

This breaks per-user cost attribution / chargeback when a key is shared across users (e.g. one key per team or per session, with `user` distinguishing individuals). Per-request end-user rate limits (`end_user_tpm_limit` / `end_user_rpm_limit`) and `allowed_model_region` are pinned the same way, since they travel together on the cached token.

Note: `request_tags`…