fix: migrate OpenRouter verification to authenticated JSON APIs

[mingyech]

Summary

• replace OpenRouter Next.js Server Action and bundle scraping with authenticated JSON API calls
• read account privacy state from /api/frontend/v1/private/users/current
• select the declared default workspace from /api/frontend/v1/private/user/workspaces?scope=member
• list every management-key page, then create and delete verifier keys through the current frontend API contracts
• distinguish rejected sessions (401/403) from upstream or schema failures (502)
• redact cookies, authorization headers, response bodies, and key material from diagnostics
• run go test ./... in CI before the reproducible Nix image build

Root cause

The original version of this PR assumed OpenRouter had changed the verifier's required Server Action IDs from 40–42 characters to 64 characters. Live authenticated inspection disproved that:

• the quoted 64-character values were predominantly cryptographic constants
• current public Server Action registrations still use 42-character IDs
• the verifier's former activity and management action names are absent from the authenticated route bundles
• OpenRouter moved these flows to cookie-authenticated JSON endpoints

Widening the action-ID regex therefore could not restore registration.

Implementation

The existing Clerk refresh remains unchanged. After refresh, the verifier now:

1. fetches the current user JSON envelope for email and account privacy toggles
2. fetches workspace memberships and selects the item matching default_workspace_id
3. follows every page from /api/frontend/v1/private/management-keys, rejecting incomplete or non-progressing pagination
4. creates a management key with a single POST /api/frontend/v1/private/workspace-api-keys/management request using {"name":"..."}
5. deletes a management key with PATCH /api/frontend/v1/private/workspace-api-keys/{hash} and {"payload":{"deleted":true},"opts":{"is_provisioning_key":true}}

Creation is not blindly retried. If the POST outcome is ambiguous, the verifier reconciles and removes a possible same-label orphan. Deletion only succeeds when the response explicitly confirms data.deleted=true.

All action-hash discovery, bundle downloads, RSC parsing, and HTML regex parsing have been removed from production.

Verification

Authenticated, read-only live validation against OpenRouter on 2026-08-26 UTC confirmed:

• current-user endpoint: JSON 200, {data: ...}, with email and every required account toggle
• workspaces endpoint: JSON 200, with data, active_workspace_id, and default_workspace_id; the default ID matched a workspace item and its data-discount toggle was present
• management-keys endpoint: JSON 200, {data:{keys,total_count}}, with the expected key metadata fields
• current deployed bundle/source-map contracts match the create and PATCH payloads implemented here

PR #7 independently live-tested the same management-key API with a 164-key account, including pagination and a create/list/delete roundtrip with cleanup. This branch preserves that pagination behavior while removing the legacy scraper fallback and making mutation failure handling safer.

Local verification:

• go test -count=1 ./...
• go test -race -count=1 ./internal/openrouter ./internal/server
• go vet ./...
• git diff --check
• independent implementation and test review: no release blockers

No additional live mutation was performed against the authenticated account while preparing this update. The create/delete contract is covered by request/response integration tests, and the CI attestation job remains the final staging check before deployment.