fix(llm): take model ids from ai-kit, and try more than one

[catomean]

fix(llm): take model ids from ai-kit, and try more than one

Both ids in API_CONFIG have been retired by their vendors:
llama-3.1-8b-instant at Groq and openai/gpt-oss-20b:free at OpenRouter. With
a valid key, this app's chatbot was answering 404.

Nothing was neglected here. The constant carried the correct instruction —
"free catalogues rot; when it does, replace it with another :free id" — and
that is precisely the maintenance that did not happen, because nothing tells a
constant when it has stopped being true. So the ids leave this repo. ai-kit
holds one list for the fleet, re-probes it against the live catalogues, and
dotfiles' daily audit asks both vendors whether those ids still exist.

One id was also not enough on its own. generateWithBestProvider picks ONE
provider and calls it exactly once, so a retirement had nothing between it and
a dead chatbot. Each vendor's call now walks that vendor's list: a 404 (retired)
or a 429 (busy or spent) steps to the next model instead of surfacing.

This is model-level fallback, not vendor-level — provider selection is untouched.
That is the smaller half of the protection, since a spent daily budget is
org-wide and kills every model at a vendor together. It is also the half that
covers rot, which is what actually happened here, twice.

An explicit caller override is still honoured as-is and alone. If someone names
a model, quietly answering from a different one is worse than failing.

The cost rule that lived in the deleted comment survives, and got stronger.
free-fallback.test.ts used to regex ONE constant; it now runs modelCost over
every OpenRouter id this app could send, using the same function the rest of the
fleet prices models with. OpenRouter is only reached when Groq's free tier is
spent — when nobody is watching — so a paid id there turns an outage into a bill.

The old tests deserve a note, because they passed throughout the outage: they
mocked llama-3.1-8b-instant and asserted it back, agreeing with production
about an id production was refusing. Worse, the OpenRouter test asserted
anthropic/claude-sonnet-5 — a paid model on the free-tier fallback path, the
exact thing the fleet rule forbids, green the whole time. They now assert
against the chain, plus two new cases: a retired first model falls through to a
different one, and exhausting the list names the whole list.

jest.config.js transforms ai-kit, which is ESM-only. The comment there says
what does NOT belong in that list, since a transitive entry would mean a package
leaking a dependency through a re-export — a bug to fix at the source.

verify: format, lint, typecheck, 232 tests, build.

🤖 Generated with Claude Code