feat(providers): add Kimi and OpenRouter mobile presets

[tcballard]

Summary

Implements the provider-preset portion of WF-ROADMAP-0016 as the first child
in the Phase 3 PR stack.

Adds:

• compiled Moonshot/Kimi Platform and OpenRouter direct destinations alongside OpenAI Platform
• provider-specific endpoints, model identifiers, and Keychain credential IDs
• deterministic tests for request dispatch, credential isolation, readiness, and explicit-only routing
• roadmap and iOS target documentation for the new preset boundary

Stack parent: #123

Scope

Included

• Moonshot/Kimi Platform preset using https://api.moonshot.ai/v1/chat/completions and kimi-k2.6
• OpenRouter preset using https://openrouter.ai/api/v1/chat/completions and openrouter/auto
• one bounded OpenAI-compatible executor dispatching only compiled destination configurations
• independent Keychain credential lookup for every preset
• destination publication as hosted, API-metered, signed-out until configured, and excluded from Automatic

Excluded

• dynamic model inventory or user-selected provider models; that is the next PR in this stack
• OpenAI Responses API
• account/OAuth authentication
• Apple Foundation Models and paired Mac execution
• any mutation of Automatic when a key is added

Product / Architecture Decisions

• Presets remain compiled, reviewed configuration rather than downloadable provider logic.
• Each destination maps to exactly one endpoint, model, and credential ID.
• Provider credentials cannot ready or execute another provider's destination.
• OpenRouter Auto is an explicit pinned destination; it is not silently inserted into Wayfinder Automatic.
• Kimi account authentication remains blocked separately; this PR adds API-key execution only.

User-Facing Contract

iOS

• Adding a Moonshot/Kimi Platform key makes Kimi K2.6 selectable in Chat.
• Adding an OpenRouter key makes OpenRouter Auto selectable in Chat.
• Adding any provider key readies only that provider's matching destination.
• All direct destinations remain opt-in selections and hosted requests leave the device.

Credentials

• Keys remain in the device-only, non-synchronizing iOS Keychain.
• App-visible state contains readiness only.
• Secrets are read inside the provider execution actor and never copied into route receipts or persistence.

Verification

Ran

• xcrun swift-format format --in-place on all changed Swift files
• iOS Simulator test through XcodeBuildMCP using WayfinderIOS on iPhone 17
• git diff --check

Covered

• 47 tests passed, 0 failed, 0 skipped
• every compiled preset sends its documented endpoint and model identifier
• each preset sends only its own bearer credential
• a configured OpenAI key cannot execute the Moonshot destination
• readiness changes remain provider-scoped
• no preset becomes Automatic-eligible
• existing SSE fragmentation, cancellation, bounds, error classification, persistence, and Keychain tests remain green

Review Path

1. OpenAICompatibleConfiguration preset definitions and multi-configuration dispatch
2. liveDirectProviders destination publication and production app wiring
3. preset credential and routing boundary tests
4. roadmap and iOS README updates

Notes For Reviewer

The child PR will target this branch and add authenticated model
inventory/discovery without expanding this preset diff. Review the
endpoint/model constants carefully; they follow the providers' current official
documentation as of 2026-07-25.

Implementation Process

Implemented with AI assistance under the roadmap contract; final scope, review,
and acceptance decisions remain with the maintainer.