JVNAUTOSCI-2518 Add opt-in OpenRouter provider

[witbrock]

Merge impact: Authorised Von users can explicitly select and evaluate exact OpenRouter models through a privacy-constrained, provenance-bearing provider path without changing existing provider defaults.

Merge decision: ready — the bounded candidate meets its minimum ship criteria, affected tests are green, and no candidate-caused stop-ship condition remains.

User outcome

Von gains OpenRouter as an explicit opt-in inference source, broadening the model portfolio while retaining exact actor-scoped provider/model eligibility, visible provider identity, and fail-closed selection.

Material changes

• Adds OpenRouter to scoped settings, browser preferences, server generation, workflow/orchestrator routing, replay tooling, model-prefix handling, and OpenStack bootstrap.
• Resolves credentials only from OPENROUTER_API_KEY or OPENROUTER_API_KEY_FILE; key values are not persisted or returned.
• Reuses the structured OpenAI-compatible Chat Completions adapter under explicit provider=openrouter identity.
• Enforces zdr: true, data_collection: "deny", require_parameters: true, and router-metadata requests at the provider boundary. This prevents an in-scope direct or structured caller from weakening the declared privacy/compatibility profile; the restriction is limited to OpenRouter requests.
• Records requested/effective provider and model, generation id, sanitised routing metadata, usage, and provider-reported cost when supplied.
• Adds current catalogue discovery, Settings controls, infrastructure secret-file support, tests, and an operator note.

Jira: https://naoinstitute.atlassian.net/browse/JVNAUTOSCI-2518

Evidence

• pdm run pytest -q across the OpenRouter, key resolution, Settings probe, structured transport/client, registry, parameter, eligibility, generate-resolution, and OpenStack-template suites: 239 passed.
• npm test -- --runInBand tests/frontend: 87 suites / 469 tests passed.
• Changed static frontend lint and JavaScript syntax checks passed.
• Changed Python syntax checks passed.
• Inspect-only exchange replay accepted provider=openrouter and the exact model slug without issuing a model request.
• git diff --check and secret-pattern inspection passed.
• Focused type checking has no OpenRouter-introduced diagnostic; the legacy llm_interface.py retains one pre-existing Gemini SDK typing mismatch.

Ship boundary

• Minimum ship criteria: exact OpenRouter selection does not collapse to OpenAI or Ollama; exact eligibility precedes calls; Chat and structured-tool requests carry the conservative provider profile; telemetry preserves actual provider/model/routing/cost evidence without inventing unavailable values; existing affected providers remain green.
• Stop-ship conditions: eligibility bypass, silent cross-provider or cross-model fallback, hidden substitution, absent privacy constraints, secret exposure, broken tool lineage, or material regression on an existing affected provider path.
• Non-blocking observations: no OpenRouter credential is configured in this checkout, so no live provider request was made and this PR does not claim live provider or model-policy certification. Terraform CLI is unavailable locally; the repository infrastructure-template tests passed.
• Non-goals: OpenRouter Auto Router, cross-model fallback policy, Responses beta, embeddings, response caching, OpenRouter server tools/plugins/guardrails, deployment, and activation.