fix(ai-gateway): avoid tainted BYOK log format

[kilo-code-bot]

Summary

• Replaces the BYOK provider debug log's user-controlled template literal format string with a constant format string.
• Preserves the existing logged model id and provider list while preventing modelId from being interpreted as a console format string.

Verification

N/A - no manual verification needed for this logging-only security fix.

Visual Changes

N/A

Reviewer Notes

• Resolves CodeQL alert 408 (js/tainted-format-string) in apps/web/src/lib/ai-gateway/byok/index.ts.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

One-line security fix correctly replaces a tainted template-literal format string with a constant format string plus %s substitution, eliminating the CodeQL js/tainted-format-string finding with no behavioural change.

Files Reviewed (1 file)

• apps/web/src/lib/ai-gateway/byok/index.ts

---

_{Reviewed by claude-sonnet-4.6 · 169,086 tokens}

_{Review guidance: REVIEW.md from base branch main}