feat: add OrcaRouter as a named AI provider

[Marc-oss-hub]

Summary

Adds OrcaRouter as a named provider, mirroring the existing OpenRouter and OpenAI-compatible integrations. OrcaRouter is an OpenAI-compatible model routing gateway that exposes 150+ models from OpenAI, Anthropic, Google, DeepSeek, Qwen and others behind a single endpoint (https://api.orcarouter.ai/v1) and one API key, using fully-namespaced model ids (e.g. openai/gpt-5-nano, openai/text-embedding-3-small). It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

Changes

• crates/atomic-core/src/providers/mod.rs — new ProviderType::OrcaRouter variant and orcarouter_* config fields (api key, llm / agentic / embedding model, context length, timeout). The provider reuses the shared OpenAI-compatible transport pinned to https://api.orcarouter.ai/v1, with OrcaRouter-valid defaults (openai/text-embedding-3-small at 1536 dims for embeddings, openai/gpt-5-nano for LLM tasks).
• crates/atomic-core/src/settings.rs — registers orcarouter_api_key as a workspace-only credential, orcarouter_embedding_model as an embedding-space key, and seeds the new defaults.
• crates/atomic-core/src/agent.rs, src/lib.rs, src/reports/agentic.rs — resolve models for chat, wiki, tagging, and reports through the new provider.
• crates/atomic-cloud/src/tenant_plane.rs — validates OrcaRouter keys against the gateway's /v1/models endpoint for BYOK entry.
• crates/atomic-server/src/routes/settings.rs — new POST /api/settings/test-orcarouter connection-test endpoint (key checked against /v1/models, no credits spent).
• src/components/settings/SettingsModal.tsx — OrcaRouter option in the provider dropdown, API key entry with inline connection test, and model configuration.
• src/lib/api.ts, src/lib/transport/command-map.ts, src/stores/settings.ts, src/lib/settings.ts — frontend plumbing for the new setting and test endpoint.
• docs/manual/getting-started/ai-providers.md — OrcaRouter section and defaults table.

Why a named provider rather than the OpenAI-compatible escape hatch

This mirrors how OpenRouter is wired in this repo: a named provider with its own API-key setting, connection test, and model defaults. A generic openai_compat entry would require the user to hand-enter https://api.orcarouter.ai/v1 plus the exact namespaced model ids every time; the dedicated provider sets those up by default and keeps the Settings UI consistent with the other providers.

How to use it

1. Get an API key at https://www.orcarouter.ai/console (keys start with sk-orca-).
2. In Settings, pick OrcaRouter as the provider and paste your key.
3. The defaults (openai/text-embedding-3-small, openai/gpt-5-nano) work out of the box; any catalog model id can be entered.

Verification

• Unit tests: cargo test -p atomic-core --lib providers:: — 86 passed, 0 failed.
• Compiles: cargo check -p atomic-core -p atomic-cloud -p atomic-server clean; tsc --noEmit clean.
• Live API: GET https://api.orcarouter.ai/v1/models with a real sk-orca- key returns 200; both default model ids (openai/text-embedding-3-small, openai/gpt-5-nano) are present in the catalog.

I'm an engineer on the OrcaRouter team.