feat(auth): support OpenAI-compatible BYOK

[xjdr-noumena]

Summary

Adds first-class OpenAI-compatible BYOK support for the OSS CLI without requiring Noumena platform login:

• supports OPENAI_API_KEY as a direct static BYOK credential
• supports OPENAI_BASE_URL for OpenAI-compatible providers such as OpenRouter
• supports OPENAI_MODEL as the default model for OpenAI-compatible BYOK
• keeps Noumena OAuth/platform login independent from inference provider selection
• prevents OPENAI_API_KEY from becoming a Noumena x-api-key
• disables Noumena-specific OpenAI-compatible behavior for external BYOK: no WS2, no x-noumena-model, no managed model ID rewrite
• preserves path-prefixed endpoints such as https://openrouter.ai/api/v1
• blocks checked-in project settings from silently setting OpenAI BYOK routing/auth env vars

This intentionally handles the env-native BYOK slice from #22. It does not add a project-local provider registry; that still needs explicit trust/consent before project settings can read ambient env keys.

Also includes the already-present branch test corrections for GLM 5.2 base vs [1m] context expectations and auth-flow preflight endpoint expectations.

Validation

Focused BYOK/provider suite:

PATH="$HOME/.bun/bin:$PATH" timeout 90s $HOME/.bun/bin/bun test \
  src/utils/authEnv.test.ts \
  src/auth/runtime/AuthRuntime.test.ts \
  src/auth/capabilities/remote.test.ts \
  src/services/api/client.authE2E.test.ts \
  src/services/api/errors.auth.test.ts \
  src/services/api/inferenceClient.test.ts \
  src/services/api/openAICompatInferenceClient.test.ts \
  src/utils/model/providers.test.ts \
  src/utils/model/model.auth.test.ts \
  src/utils/model/modelOptions.auth.test.ts \
  src/utils/managedEnvConstants.test.ts

Result: 132 pass, 0 fail.

Auth suite:

PATH="$HOME/.bun/bin:$PATH" timeout 120s $HOME/.bun/bin/bun run test:auth

Result: 453 pass, 0 fail.

Contracts suite:

PATH="$HOME/.bun/bin:$PATH" timeout 120s $HOME/.bun/bin/bun run test:contracts

Result: 238 pass, 0 fail.

Inference contracts:

PATH="$HOME/.bun/bin:$PATH" timeout 90s $HOME/.bun/bin/bun run test:inference-contracts

Result: 59 pass, 0 fail.

Canonical build:

PATH="$HOME/.bun/bin:$PATH" timeout 300s $HOME/.bun/bin/bun run build

Result: passed. Built /mlstore/src/noumena-network/code/.tmp/packages/ncode-0.1.0-linux-x64/ncode.

Live OpenRouter smoke with OPENAI_API_KEY from ~/.or_key:

OPENAI_API_KEY="$(tr -d '\r\n' < ~/.or_key)" \
OPENAI_BASE_URL='https://openrouter.ai/api/v1' \
OPENAI_MODEL='inclusionai/ling-2.6-flash' \
$HOME/.bun/bin/bun -e '...listModels smoke...'

Result: passed; model was listed.

Non-streaming live chat:

OPENAI_API_KEY="$(tr -d '\r\n' < ~/.or_key)" \
OPENAI_BASE_URL='https://openrouter.ai/api/v1' \
OPENAI_MODEL='inclusionai/ling-2.6-flash' \
$HOME/.bun/bin/bun -e '...chat smoke...'

Result: passed; response text ok.

Streaming live chat:

OPENAI_API_KEY="$(tr -d '\r\n' < ~/.or_key)" \
OPENAI_BASE_URL='https://openrouter.ai/api/v1' \
OPENAI_MODEL='inclusionai/ling-2.6-flash' \
$HOME/.bun/bin/bun -e '...stream smoke...'

Result: passed; response text ok, stop reason end_turn.

Built binary live smoke:

OPENAI_API_KEY="$(tr -d '\r\n' < ~/.or_key)" \
OPENAI_BASE_URL='https://openrouter.ai/api/v1' \
OPENAI_MODEL='inclusionai/ling-2.6-flash' \
timeout 90s .tmp/packages/ncode-0.1.0-linux-x64/ncode --print --model inclusionai/ling-2.6-flash --max-turns 1 'Reply exactly: ok'

Result: passed; printed ok.

Refs #22 for the env-native OpenAI-compatible BYOK slice. Provider registry remains out of scope.