feat: add OrcaRouter as a named model provider

[XiaoHuo888-hue]

Summary

OrcaRouter is an OpenAI-compatible model routing gateway that brings 150+ models from OpenAI, Anthropic, Google, DeepSeek, Qwen, MiniMax and xAI behind a single endpoint and API key. Beyond routing, it runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes. This PR registers it as a named provider so users can opt in directly.

OrcaRouter joins the same direct-override path the codebase already defines for openrouter (getConfigurationForModel), so the model picker, provider list, secrets, and docs stay consistent.

Changes

• worker/agents/inferutils/config.types.ts: add ORCAROUTER_AUTO (orcarouter/auto) to MODELS_MASTER as a directOverride model.
• worker/agents/inferutils/core.ts: add case 'orcarouter' to the direct-override switch → baseURL https://api.orcarouter.ai/v1, key from ORCAROUTER_API_KEY (keys start with sk-orca-).
• worker/types/env.d.ts: declare ORCAROUTER_API_KEY.
• .dev.vars.example: document ORCAROUTER_API_KEY.
• worker/types/secretsTemplates.ts: add an OrcaRouter API key template (vault).
• worker/api/controllers/modelConfig/byokHelper.ts: recognize orcarouter as an env-key-enabled platform provider so the model shows in the picker.
• worker/database/services/ModelTestService.ts: map orcarouter → orcarouter/auto for provider connection tests.
• scripts/setup.ts + docs/setup.md: add OrcaRouter to the setup provider selection list.
• worker/agents/inferutils/core.test.ts: add a direct-override test asserting the OrcaRouter base URL and key.

Testing

• bunx vitest run worker/agents/inferutils/core.test.ts — 8 passed (includes the new OrcaRouter direct-override case).
• bun run typecheck — passed (tsc -b --incremental --noEmit).
• bun run lint — 0 errors (2 pre-existing warnings in src/components/layout/header-context.tsx).
• L3 live test with a real key through the exact provider wire path (GET /v1/models + POST /v1/chat/completions with orcarouter/auto, Bearer key) → 200, routed upstream, response received.

I'm an engineer on the OrcaRouter team.