feat: add OrcaRouter as a built-in provider

[armyluki-wq]

Why

Tau describes itself as "a coding agent that lives in your terminal" and a
teaching project for understanding the shape of a coding-agent system. For
that to stay true, the built-in provider list in /login should keep up with
the gateways people actually run agents through. Tau already ships an
OpenRouter entry as a first-class provider; this PR adds the same treatment
for OrcaRouter.

OrcaRouter is an OpenAI-compatible AI gateway built for both models and
agents. Like OpenRouter, it exposes a provider/model namespace across many
models — but it also combines adaptive routing, automatic failover,
zero-markup inference, observability, guardrails, and agent-tool governance
behind the same endpoint. Adding orcarouter as a first-class provider means
Tau users can use that stack directly, without treating OrcaRouter as an
anonymous custom base URL.

It also runs gateway-level, zero-trust security for AI agents on the same
endpoint — screening every prompt/response and governing every tool call on a
default-deny basis, with no application code changes.

What changed

The built-in catalog is data, not code: I added an orcarouter entry to
src/tau_coding/data/catalog.toml, following the exact shape of the existing
openrouter entry:

• kind = "openai-compatible", api = "openai-completions", base URL
  https://api.orcarouter.ai/v1, credential env ORCAROUTER_API_KEY.
• 113 chat-capable models across Anthropic, DeepSeek, Google, Kimi, MiniMax,
  OpenAI, Qwen, xAI, and Z.AI, plus the orcarouter/auto adaptive-router and
  orcarouter/free aliases. Model IDs use OrcaRouter's vendor/model
  namespace, matching how Tau already presents OpenRouter.
• Per-model context_windows, max_tokens, and cost rates were pulled from
  OrcaRouter's live /v1/models/<id> metadata endpoint (verified today).
• Thinking levels use reasoning_effort, so the existing OpenAI-compatible
  transport handles reasoning without any provider-specific code.

Because provider configuration flows through Tau's normal catalog → settings →
runtime path, no Python changes were needed — this mirrors how CONTRIBUTING.md
describes adding a provider: "The built-in provider catalog is data, not
code: edit src/tau_coding/data/catalog.toml and open a PR."

Checks

• uv run pytest — 1852 passed, 3 skipped
• uv run ruff check . — passed
• uv run ruff format --check . — passed
• uv run mypy — passed
• Live test: tau --provider orcarouter --model openai/gpt-5.4 -p "Say OK"
  returned OK through Tau's orcarouter provider path (HTTP 200).

Docs

Updated the providers guide, quickstart, concepts, what-is-tau, and README to
list OrcaRouter alongside OpenRouter.

Discord: discord.gg/YEubt8enRA · X: https://x.com/OrcaRouter

I'm an engineer on the OrcaRouter team.