feat(providers): add Kimi and OpenRouter mobile presets

[tcballard]

Summary

Implements the provider-preset portion of WF-ROADMAP-0016 as the next
Phase 3 slice after merged PR #123.

Adds:

• compiled Moonshot/Kimi Platform and OpenRouter direct destinations alongside OpenAI Platform
• provider-specific endpoints, model identifiers, and Keychain credential IDs
• deterministic tests for request dispatch, credential isolation, readiness, and explicit-only routing
• roadmap and iOS target documentation for the new preset boundary

This replaces automatically closed PR #124. GitHub closed that stacked PR when
#123's head branch was deleted after merge; the branch was then mechanically
restacked onto current main.

Scope

Included

• Moonshot/Kimi Platform preset using https://api.moonshot.ai/v1/chat/completions and kimi-k2.6
• OpenRouter preset using https://openrouter.ai/api/v1/chat/completions and openrouter/auto
• one bounded OpenAI-compatible executor dispatching only compiled destination configurations
• independent Keychain credential lookup for every preset
• destination publication as hosted, API-metered, signed-out until configured, and excluded from Automatic

Excluded

• dynamic model inventory or user-selected provider models; that remains in child PR feat(providers): discover direct mobile models #125
• OpenAI Responses API
• account/OAuth authentication
• Apple Foundation Models and paired Mac execution
• any mutation of Automatic when a key is added

Product / Architecture Decisions

• Presets remain compiled, reviewed configuration rather than downloadable provider logic.
• Each destination maps to exactly one endpoint, model, and credential ID.
• Provider credentials cannot ready or execute another provider's destination.
• OpenRouter Auto is an explicit pinned destination; it is not silently inserted into Wayfinder Automatic.
• Kimi account authentication remains blocked separately; this PR adds API-key execution only.

User-Facing Contract

iOS

• Adding a Moonshot/Kimi Platform key makes Kimi K2.6 selectable in Chat.
• Adding an OpenRouter key makes OpenRouter Auto selectable in Chat.
• Adding any provider key readies only that provider's matching destination.
• All direct destinations remain opt-in selections and hosted requests leave the device.

Credentials

• Keys remain in the device-only, non-synchronizing iOS Keychain.
• App-visible state contains readiness only.
• Secrets are read inside the provider execution actor and never copied into route receipts or persistence.

CLI

No CLI changes.

JSON Output

No JSON contract changes.

Exit Codes

No process or exit-code changes.

Verification

Ran

• xcrun swift-format format --in-place on all changed Swift files
• iOS Simulator test through XcodeBuildMCP using WayfinderIOS on iPhone 17
• git diff --check

Covered

• 47 tests passed, 0 failed, 0 skipped
• every compiled preset sends its documented endpoint and model identifier
• each preset sends only its own bearer credential
• a configured OpenAI key cannot execute the Moonshot destination
• readiness changes remain provider-scoped
• no preset becomes Automatic-eligible
• existing SSE fragmentation, cancellation, bounds, error classification, persistence, and Keychain tests remain green

Review Path

1. OpenAICompatibleConfiguration preset definitions and multi-configuration dispatch.
2. liveDirectProviders destination publication and production app wiring.
3. Preset credential and routing boundary tests.
4. Roadmap and iOS README updates.

Notes For Reviewer

Child PR #125 adds authenticated model inventory/discovery without expanding
this preset diff. Review the endpoint/model constants carefully; they follow
the providers' official documentation as of 2026-07-25.

Implementation Process

Implemented with AI assistance under the roadmap contract; final scope, review,
and acceptance decisions remain with the maintainer.