feat: add OrcaRouter as a named OpenAI-compatible provider

[JinhaoSong322]

Add OrcaRouter as a named OpenAI-compatible provider

Adds OrcaRouter as a first-class model provider alongside OpenAI, Anthropic, and Gemini. OrcaRouter is an OpenAI-compatible gateway that routes each request to the best available model automatically via orcarouter/auto. It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

What changed

• backend/llm.py — register orcarouter/auto and expose ORCAROUTER_MODELS.
• backend/agent/providers/factory.py — dispatch OrcaRouter models to the existing OpenAI-compatible Responses session, pointed at https://api.orcarouter.ai/v1.
• backend/routes/generate_code.py — accept ORCAROUTER_API_KEY from backend/.env or the settings dialog; when set, use the OrcaRouter gateway model for every variant.
• backend/config.py, backend/evals/core.py, backend/agent/engine.py, backend/agent/tools/runtime.py — thread the OrcaRouter key/base URL through the agent pipeline and eval runner.
• frontend — add OrcaRouter API key + base URL fields to the Settings dialog, and register orcarouter/auto in lib/models.ts.
• README.md — document the new key.

How it works

The app already has an OpenAI-compatible code path that talks to the Responses API with configurable base_url. OrcaRouter exposes the same endpoint shape, so this reuses that proven session — no new transport or streaming code.

Verification

• Backend: pytest — 276 passed.
• Frontend: tsc --noEmit clean, eslint clean on changed files, jest — 42 passed.
• Live: a real request through the new provider path (via create_provider_session for orcarouter/auto) returned a streaming 200 response from https://api.orcarouter.ai/v1/responses.

Disclosure: I'm an engineer on the OrcaRouter team.