Improve live protocol diagnostics for OpenRouter and other providers.
- Distinguish API-key authentication failures from protocol incompatibility.
- Report 403/WAF blocks and transient upstream failures separately.
- Keep all-model scans undetermined and non-destructive when the shared credential fails.
- Continue supporting @deepseek-ai/dsh@0.1.2-alpha.3.