EUrouter: re-add once it allows browser calls via CORS (removed for now)

[jstet]

EUrouter only allows its own site via CORS, so the browser can't call it directly and requests go through the /api/eurouter/v1 proxy in serve.js. That means the user's API key, prompts and generated questions pass through the formulaid host. Nothing is stored there, but every request path is logged.

Checked 2026-09-25 with Origin: https://formulaid.example.org:

• OPTIONS /api/v1/chat/completions → 204, but access-control-allow-origin: https://www.eurouter.ai
• POST and GET /api/v1/models → same, with only https://www.eurouter.ai allowed

Options:

1. Ask EUrouter to allow formulaid's production origin (or * for /api/v1, as OpenRouter does). Then switch baseUrl to https://api.eurouter.ai/api/v1 and remove the proxy. Together with the OpenRouter change, serve.js could go entirely and the static build could be hosted on any static host.
2. Keep the proxy and make it explicit: say in the provider selection / privacy text that EUrouter requests are relayed through the formulaid server without being stored, stop logging proxied paths, and don't forward cookies.

Option 1 is preferred; option 2 applies until EUrouter responds.

[jstet]

Option 2 is done in 3e946d4 and c8b9b64. The proxy now drops Cookie and Referer on the way out and Set-Cookie on the way back, and logs only the error message. The model section tells EUrouter users that their requests are relayed through the FormulAid server, and DEPLOYMENT.md documents this. Still open is option 1: asking EUrouter to allow FormulAid's production origin (or *) for /api/v1. That needs someone to contact them. Once they do, set baseUrl to https://api.eurouter.ai/api/v1 and remove the proxy from serve.js.

[jstet]

EUrouter removed for now (bb9ae50)

Relaying EUrouter through our server contradicted what the app is supposed to be: fully client-side, with the key and prompts never reaching the FormulAid host. So EUrouter has been removed from the providers, and the proxy is gone from serve.js and vite.config.ts. serve.js now only serves build/, so any static host works. If someone had an EUrouter key saved, it is cleared on load and never sent to OpenRouter.

The EUrouter proxy was only in place since 3e946d4 and 4aefd1f (option 2), and was removed again in bb9ae50.

Checked again on 2026-09-25

OPTIONS and GET https://api.eurouter.ai/api/v1/models with Origin: https://formulaid.example.org still return access-control-allow-origin: https://www.eurouter.ai, with access-control-allow-credentials: true.

Adding it back

Precondition: EUrouter allows https://formulaid.correlaid.org (or *) via CORS on /api/v1/*, including the Authorization and Content-Type headers and POST. Check with:

curl -s -X OPTIONS -D - -o /dev/null \
  -H 'Origin: https://formulaid.correlaid.org' \
  -H 'Access-Control-Request-Method: POST' \
  -H 'Access-Control-Request-Headers: authorization,content-type' \
  https://api.eurouter.ai/api/v1/chat/completions | grep -i access-control

Contact: https://www.eurouter.ai/contact or https://github.com/eurouter.

Then (no proxy!):

1. src/lib/constants.ts: add 'eurouter' to ProviderId and this entry to PROVIDERS:

   {
   	id: 'eurouter',
   	label: 'EUrouter (EU / GDPR)',
   	baseUrl: 'https://api.eurouter.ai/api/v1',
   	defaultModel: 'mistral-medium-3.1', // EUrouter ids have no vendor prefix
   	keysUrl: 'https://www.eurouter.ai/',
   	modelsUrl: 'https://www.eurouter.ai/models'
   }

2. src/lib/settings.svelte.ts, in load(): add 'eurouter' to the accepted providers and to the list of saved model keys. Otherwise the removed-provider branch clears the key.
3. src/lib/agents/config.ts: EUrouter goes through the generic OpenAI-compatible client, whose custom fetch strips ax's X-Request-ID/X-Retry-Count headers. Check that EUrouter's preflight doesn't need more than that. If it rejects other headers, strip them the same way.
4. DEPLOYMENT.md: add a row "EUrouter | browser, directly" to the table.
5. wp_eins src/content/snippets/formulaid/{de,en}.html: put the EUrouter link back next to OpenRouter.
6. Test one real generation in the browser with an EUrouter key, including cancelling. The key check on save (+layout.svelte) uses /models for providers other than OpenRouter.

Keeping this issue open until then.