feat: add OrcaRouter as a named OpenAI-compatible provider

[XiaoHuo888-hue]

Adds OrcaRouter as a named provider. With one API key, users get 150+ models from OpenAI, Anthropic, Google, DeepSeek, Qwen, MiniMax and xAI behind a single endpoint. Because the provider catalog entry is a thin base-URL swap, any PilotDeck pipeline/agent that uses it also inherits OrcaRouter's gateway-level, zero-trust security controls for AI agents — with no application code changes. The gateway screens every prompt and response and governs every tool call on a default-deny basis, across four layers:

• Scoped keys — bind a key to specific models, IPs, spend caps, and expiry.
• Guardrails — screen for PII, secret leakage, prompt injection, and unsafe output.
• Agent firewall — tool allow-lists with per-argument validation.
• Audit trail — a record of every match, verdict, and approval decision.

I'm an engineer on the OrcaRouter team.

Summary

Registers OrcaRouter as a first-class, named OpenAI-compatible provider, mirroring the existing OpenRouter aggregator entry so the onboarding/settings provider picker, model-config resolution and docs stay consistent. With a single ORCAROUTER_API_KEY (keys start with sk-orca-) users can pick orcarouter/auto (auto-routes each request) or namespaced ids such as anthropic/claude-sonnet-4.6 against https://api.orcarouter.ai/v1.

Changes

• src/model/catalog/providers.ts — engine catalog entry: orcarouter (protocol: openai, default URL https://api.orcarouter.ai/v1, ORCAROUTER_API_KEY), so parseModelConfig resolves URL/protocol/env key like the built-in providers.
• ui/src/shared/catalogProviders.ts — UI mirror entry with modelListUrl: https://api.orcarouter.ai/v1/models (dynamic model list) and a few curated model examples.
• tests/model/config/parseModelConfig.spec.ts — 2 tests: catalog default resolution + chat endpoint construction.
• ui/src/shared/catalogProviders.test.ts — 1 test for the UI provider entry.
• README.md / README.zh.md — OrcaRouter config example (orcarouter/auto + namespaced ids).

The endpoint plumbing needs no changes: protocol: "openai" already builds /chat/completions and /models from the base URL, and OrcaRouter accepts both auto-routing and vendor/model namespaced ids.

Verification

Check	Command	Result
Engine model tests	tsx --test tests/model/**/*.spec.ts	✅ 21 passed (incl. 2 new OrcaRouter tests)
UI provider catalog tests	vitest run src/shared/catalogProviders.test.ts	✅ 5 passed (incl. 1 new OrcaRouter test)
Type check (changed files)	tsc --noEmit (engine + ui)	✅ no errors in changed files
Live models list	GET https://api.orcarouter.ai/v1/models	✅ 200, 205 models
Live chat completion (orcarouter/auto)	POST https://api.orcarouter.ai/v1/chat/completions	✅ 200, replied ORCA-OK
Live chat completion (anthropic/claude-sonnet-4.6)	POST https://api.orcarouter.ai/v1/chat/completions	✅ 200, replied ORCA-OK