Fix null CADBrief tolerances and Web UI OpenRouter/key fallback

[pravsels]

Summary

• Coerce explicit null tolerance_upper / tolerance_lower values to the schema default (0.1) so Spec Planner JSON from non-DashScope models (e.g. OpenRouter) validates instead of retry-looping
• Web UI: fall back to DS_API_KEY in config.py / DASHSCOPE_API_KEY when the form key is blank (key is still never sent to the browser in the schema)
• Add an OpenRouter provider preset (model hint qwen/qwen3-max, matching the existing Qwen default) and select the preset that matches DS_BASE_URL
• Artifact buttons open in a new tab without leaving the result page: Python/JSON as text; GLB/STL in a 3D viewer page; STEP shows the GLB mesh preview (browsers cannot render STEP)
• No changes to the default DashScope base URL or qwen3.7-max model settings

Test plan

• Start Web UI, leave API key blank with DS_API_KEY set in config.py, confirm Generate starts
• Select OpenRouter preset and confirm base URL / model hint fill in as qwen/qwen3-max
• Run a simple prompt through Spec Planner with a model that emits "tolerance_upper": null and confirm the planner proceeds past CADBrief validation
• After a successful run: Python/JSON open as text in a new tab; GLB/STL open a 3D viewer tab; STEP opens viewer with GLB mesh note; original result page stays intact
• Confirm existing DashScope/Qwen flow still works with the form key filled