feat: add orcarouter as a named provider

[martinzudergaming-a11y]

Adds OrcaRouter as a named provider, so ifixai run --provider orcarouter can use an OpenAI-compatible AI gateway built for both models and agents. Like OpenRouter — which iFixAi already treats as a first-class provider — OrcaRouter exposes a provider/model namespace across many models, but it also combines adaptive routing, automatic failover, zero-markup inference, observability, guardrails, and agent-tool governance behind the same endpoint. Making it a first-class provider means iFixAi users get that whole stack directly, without treating OrcaRouter as an anonymous custom base URL.

The PR mirrors the existing OpenRouter adapter end to end: a new OrcaRouterProvider in ifixai/providers/orcarouter.py (same OpenAI-SDK client caching, JSON-mode fallback, and retryable-band error mapping, pointing at https://api.orcarouter.ai/v1 with an orcarouter/auto default), plus registration in the resolver, the --provider choice list, the setup wizard, the model catalog, credential env detection (ORCAROUTER_API_KEY), secret scrubbing (sk-orca-…), aggregator-vendor recognition for cross-vendor judging, and the judge fallback-model JSON. It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

Validation: ruff check ifixai, bandit -r ifixai -ll, and ifixai validate all pass. Live-tested send_message against https://api.orcarouter.ai/v1 with orcarouter/auto on both the plain and json_output judge paths:

{
  "provider": "orcarouter",
  "model": "orcarouter/auto",
  "status": "live 200",
  "plain": "OK",
  "json_output": { "verdict": "pass" }
}

Discord: discord.gg/YEubt8enRA · X: https://x.com/OrcaRouter

I'm an engineer on the OrcaRouter team.

[n-papaioannou]

Thanks for the PR. Open to include OrcaRouter, but this needs:

A real default model:orcarouter/autoisn't in your/v1/models, and auto-routing breaks judge-independence checks.
Catalog fixes:claude-sonnet-4.5andqwen3-235b-a22baren't served.
The documentedjudge_fallbacks.jsonentry actually added, or the claim removed.
Promo copy out: "zero markup", README recommended slot, judge tiebreaker insertion.
Otherwise we'll close and add the provider ourselves.