feat: add OrcaRouter as a built-in OpenAI-compatible provider

[JinhaoSong322]

Summary

Adds OrcaRouter as a first-class built-in OpenAI-compatible provider, mirroring the existing openrouter alias.

OrcaRouter is a unified gateway that routes to models from many providers (Anthropic, OpenAI, DeepSeek, Qwen, Google, and more) through a single OpenAI-compatible endpoint. It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

What changed

• pkg/model/provider/aliases.go — register orcarouter alias: API type openai, base URL https://api.orcarouter.ai/v1, token env var ORCAROUTER_API_KEY.
• pkg/config/auto.go — register orcarouter in cloudProviders (so it participates in auto-selection) and in DefaultModels (orcarouter/auto, the gateway's adaptive router).
• pkg/model/provider/openai/client.go — treat orcarouter as an open-model host so consecutive system messages are merged before sending (it fronts open-weight models from many vendors).
• docs/providers/orcarouter/index.md — new provider page (setup, inline + named model usage, how it works).
• docs/providers/overview/index.md, docs/concepts/models/index.md, docs/configuration/models/index.md — OrcaRouter rows in the provider tables/lists.
• agent-schema.json — document the new alias in the provider description.
• Tests in pkg/model/provider/aliases_test.go and pkg/config/auto_test.go covering the alias config, auto-selection, default model, and max-tokens defaults.

Usage

agents:
  root:
    model: orcarouter/orcarouter/auto
    description: Assistant using OrcaRouter
    instruction: You are a helpful assistant.

orcarouter/auto is OrcaRouter's adaptive router; any gateway-served model can be referenced with its upstream prefix (e.g. orcarouter/anthropic/claude-sonnet-4-5).

Verification

• go build ./... — clean
• go vet ./pkg/model/provider/... ./pkg/config/... ./pkg/modelinfo/... — clean
• go test ./pkg/model/provider/... ./pkg/config/... ./pkg/modelinfo/... ./pkg/httpclient/... ./pkg/fake/... ./pkg/modelsdev/... — all pass, including new orcarouter cases
• go run ./lint . — 1814 files inspected, no offenses
• gofmt -l on changed files — clean
• L3 live test: built a provider via providers.NewDefaultRegistry().New with provider: orcarouter, model: orcarouter/auto, real ORCAROUTER_API_KEY, and streamed a chat completion against https://api.orcarouter.ai/v1 — returned ORCA-OK.

Disclosure: I'm an engineer on the OrcaRouter team.

[aheritier]

👋 Some commits in this PR are not signed and verified by GitHub. Please sign your commits with a GPG or SSH key registered in your GitHub account, then force-push.

Commits that are not verified: d30e380

See GitHub's guide on signing commits for setup instructions. I've added status/needs-signed-commits; it will be removed automatically once every commit in this PR carries a valid GitHub-verified signature.