feat(cli): add OrcaRouter as a named provider

[XiaoHuo888-hue]

Summary

Adds OrcaRouter as a named provider for the CLI, wired the same way OpenRouter is today: a provider registry entry, a keystore credential, a CLI-only orcarouter: model prefix resolved to the gateway base URL, a live (24h-cached) model catalogue, and a picker section plus a models orcarouter command.

With one API key, users get 150+ models from OpenAI, Anthropic, Google, DeepSeek, Qwen, MiniMax and xAI behind a single endpoint. Because the provider is a thin base-URL swap, any pydantic-deepagents pipeline/agent that uses it also inherits OrcaRouter's gateway-level, zero-trust security controls for AI agents — with no application code changes. The gateway screens every prompt and response and governs every tool call on a default-deny basis, across four layers:

• Scoped keys — bind a key to specific models, IPs, spend caps, and expiry.
• Guardrails — screen for PII, secret leakage, prompt injection, and unsafe output.
• Agent firewall — tool allow-lists with per-argument validation.
• Audit trail — a record of every match, verdict, and approval decision.

I'm an engineer on the OrcaRouter team.

pydantic-ai has no native orcarouter: provider, so the prefix is resolved in apps/cli/model_resolve.py (mirroring the existing openai-compatible: sentinel) and the gateway base URL is fixed so users never configure it by hand.

Changes

• Add OrcaRouter to the provider registry with ORCAROUTER_API_KEY and the orcarouter: prefix (apps/cli/providers.py).
• Add the ORCAROUTER_API_KEY credential to the keystore and onboarding (apps/cli/credentials.py).
• Resolve orcarouter:<id> model strings to an OpenAIChatModel pointed at https://api.orcarouter.ai/v1 (apps/cli/model_resolve.py).
• Add a live model catalogue with a 24h cache, mirroring openrouter_models.py (apps/cli/orcarouter_models.py).
• Add an OrcaRouter section to the /model picker and a models orcarouter command (apps/cli/modals/model_picker.py, apps/cli/main.py).
• Document the provider and the new model prefix (README.md, docs/cli/settings.md).
• Add 30 tests covering the provider table, prefix resolution, keystore, catalogue cache/fetch, picker and CLI command (tests/test_cli_orcarouter.py).

Testing

• New tests added for any new functionality — 30 tests in tests/test_cli_orcarouter.py, all passing
• All tests pass locally: uv run pytest tests/test_cli_orcarouter.py → 30 passed
• Linting passes: uv run ruff format --check (294 files already formatted) and uv run ruff check → All checks passed
• Type checking passes: uv run pyright → 0 errors, 0 warnings; uv run mypy pydantic_deep tests → only the pre-existing tests/test_forking_core.py:2363 mkfifo attr-defined error on Windows (untouched by this PR)
• Security scan passes: uv run bandit -r pydantic_deep -x tests -ll → only pre-existing findings in pydantic_deep; this PR touches only apps/cli/ and adds tests

Note on the full local suite: the coverage gate (coverage fail_under = 100) is scoped to pydantic_deep (see pyproject.toml), which this PR does not modify; the remaining local failures (subprocess/symlink/timing tests) reproduce on a clean checkout of main on Windows and are unrelated to this change.

Related Issues

None.

Notes for Reviewers

The orcarouter: prefix is a CLI-level marker exactly like the existing openai-compatible: sentinel; pydantic-ai never sees it. The API key comes from the keystore (ORCAROUTER_API_KEY), never from config.toml, and OPENAI_API_KEY is never sent to the gateway.