Add OpenRouter as primary provider for managed model usage

[Al629176]

Summary

Configure OpenRouter as the primary inference provider for managed model usage in OpenCompany. This replaces or sits in front of the current TinyHumans-hosted inference endpoint, giving access to OpenRouter's full model catalogue with a single API key.

What to Add

• Inference URL: https://openrouter.ai/api/v1 (OpenAI-compatible)
• API key: stored as a secret (same pattern as %k-inference%2Fkey in the company secrets dir) — key to be supplied by the operator at deploy time via OPENCOMPANY_INFERENCE_KEY or equivalent secret injection
• Provider identity header: OpenRouter requires HTTP-Referer and optionally X-Title on each request for attribution — these should be set to the OpenCompany instance URL and product name respectively

Scope

1. Default inference URL — update the fallback/default value in src/server/ops/inference.rs (or wherever OPENCOMPANY_INFERENCE_URL is resolved) so a fresh deploy without explicit config points at OpenRouter
2. Header injection — ensure HTTP-Referer: <public_url> and X-Title: OpenCompany are sent on every inference request to satisfy OpenRouter's attribution requirement
3. Model name mapping — OpenRouter uses namespaced model IDs (e.g. anthropic/claude-sonnet-4-5, openai/gpt-4o). Verify the model IDs in company configs resolve correctly against OpenRouter's catalogue, or add a mapping layer
4. Docs — update docs/spec/runtime/ and the company README.md to document OpenRouter as the recommended managed provider and note the required env vars

Not in Scope

• Per-company BYOK (bring-your-own-key) OpenRouter — that's a separate settings surface
• Rate-limit or cost tracking per model — tracked separately

Acceptance Criteria

• OPENCOMPANY_INFERENCE_URL=https://openrouter.ai/api/v1 + OPENCOMPANY_INFERENCE_KEY=<key> produces working inference in a local dev run
• HTTP-Referer and X-Title headers are present on outbound inference requests
• /api/v1/company/capabilities returns cognition: "configured" with an OpenRouter key set
• Company configs using named models still resolve (or a clear error is returned if the model name isn't valid on OpenRouter)

[tinysweeper]

Configure OpenRouter as the primary inference provider for managed model usage, updating default URL, headers, model mapping, and docs.

Labelled priority: p3.