feat: let callers send the request fields the providers document

[simonx1]

The request body was {model, state, questions} and nothing else, built from a literal.

OpenRouter's DecisionsRequest documents four more — provider, session_id, trace, user — and none could be sent through this client at all. The official JavaScript SDK spreads the caller's request into the payload so any unknown top-level field goes through, and Python has extra_body. Here the only route was to subclass the provider and override request_body, for a session id.

client.ask(state: state, questions: questions,
           extra: { session_id: conversation_id, user: user_id })

Keys are stringified, structured values go through untouched, and model, state and questions are refused: they come from a validated client and from the arguments the answers are matched back against, so letting a hash overwrite them would decouple the request from the response handling.

request_body is a documented override point, so it gains extra: with a default and a provider written against the old three-keyword signature keeps working. Passing extra fields to one raises ConfigurationError naming the provider, rather than dropping the fields on the floor — which is the failure mode that would cost someone an afternoon.

Tests

test/extra_fields_test.rb, 12 cases, including a legacy provider that can't take them.

---

Draft: part of a security and API-coverage audit, opened for reference rather than as a request for immediate review. Independent of the other branches, each off main. Suite green on Ruby 3.2.11, 3.3.8 and 3.4.8.

🤖 Generated with Claude Code