feat: add OrcaRouter as a named LLM provider

[XiaoHuo888-hue]

Adds OrcaRouter as a named provider. With one API key, users get 150+ models from OpenAI, Anthropic, Google, DeepSeek, Qwen, MiniMax and xAI behind a single endpoint. Because the LLM provider dispatcher is a thin base-URL swap, any TaxHacker pipeline that uses it also inherits OrcaRouter's gateway-level, zero-trust security controls for AI agents, with no application code changes. The gateway screens every prompt and response and governs every tool call on a default-deny basis, across four layers:

• Scoped keys: bind a key to specific models, IPs, spend caps, and expiry.
• Guardrails: screen for PII, secret leakage, prompt injection, and unsafe output.
• Agent firewall: tool allow-lists with per-argument validation.
• Audit trail: a record of every match, verdict, and approval decision.

I'm an engineer on the OrcaRouter team.

What this changes

OrcaRouter becomes a first-class provider in the LLM settings, mirroring how the existing providers are registered:

• lib/llm-providers.ts: new orcarouter entry in the PROVIDERS registry, preconfigured endpoint https://api.orcarouter.ai/v1, default model deepseek/deepseek-v4-flash, sk-orca-... key prefix, and a link to the OrcaRouter console.
• ai/providers/llmProvider.ts: "orcarouter" added to the LLMProvider union; requestLLMUnified and testLLMProvider dispatch it through ChatOpenAI with the preconfigured base URL (overridable via the settings form).
• forms/settings.ts / models/settings.ts: the four orcarouter_* setting keys added to the form schema, SELF_HOSTED_ONLY_SETTINGS, and getLLMSettings() so the provider is saved, loaded, and picked up by the analysis router (including the default provider order).
• components/settings/llm-settings-form.tsx: OrcaRouter appears in the default provider order so it shows up in the LLM settings UI out of the box.
• public/logo/orcarouter.svg: provider logo.
• .env.example: documents ORCAROUTER_MODEL_NAME / ORCAROUTER_API_KEY.

How to use it

1. Get an API key at https://www.orcarouter.ai/console (keys start with sk-orca-).
2. In Settings → LLM settings, drag the OrcaRouter block into your provider order and paste the key (model defaults to deepseek/deepseek-v4-flash; you can override both model and endpoint).
3. Hit Test to verify the connection, then save.

Verification

• npm run lint → clean on changed files
• npm run test (vitest) → all pass
• npx tsc --noEmit → no errors on changed files
• Live API: routed a completion through the orcarouter provider path (ChatOpenAI → https://api.orcarouter.ai/v1, model deepseek/deepseek-v4-flash) with a real sk-orca- key → returned a valid completion