feat: add OrcaRouter LLM provider

[XiaoHuo888-hue]

Summary

Add OrcaRouter as a named LLM provider, mirroring the existing Atlas Cloud wiring.

OrcaRouter is an OpenAI-compatible gateway that exposes a single endpoint for a wide range of models. It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

What changed

• New OrcaRouterProvider in crates/webclaw-llm/src/providers/orcarouter.rs, delegating to the shared OpenAI-compatible transport, with ORCAROUTER_API_KEY / ORCAROUTER_BASE_URL (default https://api.orcarouter.ai/v1) / ORCAROUTER_MODEL (default orcarouter/auto) overrides — the same shape as the Atlas Cloud provider.
• Added to the default provider chain (chain.rs) as an opt-in last fallback, so it only activates when ORCAROUTER_API_KEY is set and never preempts an already-configured provider.
• Registered orcarouter in the CLI --llm-provider selector, the "no LLM providers" hints (CLI + server), env.example, and the README config tables (EN + zh-CN). CHANGELOG entry added under Unreleased.

How verified

• cargo test -p webclaw-llm — 62 passed, 0 failed.
• cargo clippy -p webclaw-llm -- -D warnings — clean.
• cargo fmt --check — clean.
• Live check against the OrcaRouter endpoint using the new provider path (orcarouter/auto): returned the expected completion.

Disclosure: I'm an engineer on the OrcaRouter team.