feat: add OrcaRouter as a first-class router provider

From the PR description

Summary

Mike is an open-source legal AI platform for document review, drafting, and legal research. It already lets self-hosters bring their own keys for a handful of model routers - OpenRouter, Vercel AI Gateway, and OpenCode Go - and pick catalog models in Settings → Bring Your Own Keys → Routers. This PR adds OrcaRouter as a first-class router next to them.

Changes

• New orcarouter router slug alongside openrouter, vercel, and opencode-go: model ids are namespaced orcarouter/<vendor>/<model>, and the user's saved selection is gated through the same user_router_models machinery.
• Settings → Bring Your Own Keys now accepts an OrcaRouter API key (sk-orca-...); the Routers section lists OrcaRouter's authenticated catalog once a key is configured, mirroring the OpenRouter entry.
• The backend resolves orcarouter/ models through an OpenAI-compatible adapter pointed at https://api.orcarouter.ai/v1, with an ORCAROUTER_API_KEY env option and ORCAROUTER_BASE_URL override for proxies, exactly like the other routers.
• A migration (20260829_01_add_orcarouter_user_api_key_provider.sql) widens the user_api_keys.provider check to include orcarouter; backend/schema.sql is updated to match.
• The Word add-in mirrors the new router in its hand-maintained catalog so add-in users see the same models.
• Adapter, catalog-route, and router-selection tests cover the new provider.

Why

Mike already treats OpenRouter and the other gateways as named routers rather than anonymous custom base URLs. OrcaRouter exposes the same provider/model namespace shape (e.g. anthropic/claude-sonnet-5, deepseek/deepseek-v4-flash) behind an OpenAI-compatible endpoint, so it fits the existing router model without a new concept. It also combines adaptive routing, automatic failover, zero-markup inference, observability, guardrails, and agent-tool governance behind the same endpoint. Adding OrcaRouter as a first-class provider means Mike's users can use that stack directly, without treating it as a hand-typed custom base URL. It also runs gateway-level, zero-trust security for AI agents on the same endpoint - screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

Testing

• npm run build --prefix backend (tsc) passes; backend unit/integration suites pass (843 passed, 25 skipped; the pre-existing health.test.ts failures are unrelated to this change).
• npm test --prefix frontend passes for the router/settings suites.
• Live check: completeWithProvider({ model: "orcarouter/deepseek/deepseek-v4-flash-free", ... }) against the real OrcaRouter endpoint returns a 200 with a normal completion.

I'm an engineer on the OrcaRouter team. Discord: discord.gg/YEubt8enRA · X: https://x.com/OrcaRouter