feat(auth): connect OpenRouter accounts and free route

[tcballard]

Summary

Adds the first approved native iOS account provider: OpenRouter OAuth PKCE, plus an explicit rate-limited OpenRouter Free destination.

Scope

• adds WF-QUAL-0002 against OpenRouter's official OAuth and free-router contracts
• connects through ASWebAuthenticationSession with Apple's HTTPS callback matcher
• encodes unguessable state in the exact HTTPS callback path
• exchanges only the documented code, verifier, and S256 method
• stores OpenRouter's user-controlled key under the existing device-only OpenRouter Keychain credential
• adds Accounts settings with connect, readiness, and disconnect states
• adds the pinned openrouter/free destination alongside openrouter/auto
• covers provider contract, credential lifecycle, route eligibility, and sign-out

Product / Architecture Decisions

• Account auth and manual API-key setup converge on one credential; no second credential broker or token store is introduced.
• OpenRouter Auto is labelled as credit-backed.
• OpenRouter Free is labelled no-cost and rate-limited, retains the existing accounting class, and cannot silently fall back to a paid destination.
• Connecting OpenRouter readies its destinations but does not mutate or enter Automatic.
• ChatGPT/Codex remains paired-Mac-only; Kimi account auth remains blocked pending provider approval.

User-Facing Contract

Settings now has a distinct Accounts screen. A user can select “Continue with OpenRouter,” authenticate in the system web sheet, then explicitly choose either OpenRouter Auto or OpenRouter Free in Chat. Disconnect removes the issued credential from this device.

Verification

• XcodeBuildMCP signed iPhone 17 simulator suite: 66 passed, 0 failed, 0 skipped
• official HTTPS callback constraint verified against current OpenRouter documentation
• exact OpenRouter authorization/exchange fixture coverage
• account connection and disconnect update destination readiness without changing Automatic
• free destination asserts openrouter/free, rate-limited copy, pinned-only eligibility, and shared credential custody
• git diff --check

Review Path

1. docs/qualifications/WF-QUAL-0002-openrouter-account-auth.md
2. ios/WayfinderIOS/WayfinderIOS/OpenRouterAccount.swift
3. ios/WayfinderIOS/WayfinderIOS/AccountsView.swift
4. ios/WayfinderIOS/WayfinderIOS/AppModel.swift
5. ios/WayfinderIOS/WayfinderIOSTests/OpenRouterAccountTests.swift

Notes For Reviewer

This is stacked on PR #126. Review and merge the earlier mobile provider stack before this layer.

AI-assisted implementation; tests, provider documentation, and repository state were verified locally.