feat(ai): multi-provider prefs, secrets IPC, shared schema core

[cordialApple]

What

Second slice of the local/multi-provider LLM work. Adds the prefs, secrets IPC, usage pricing, and shared schema core that later renderer + wiring PRs build on. All behavior-preserving: every tier still defaults to anthropic, so existing installs route 100% cloud, unchanged.

Changes

• routing.ts — export PROVIDERS runtime array (anthropic | openai | gemini) so prefs derive both the type and the enum codec values from one source.
• prefs.ts — 10 new per-role fields: provider{Architect,Evaluator,Conversation} (default anthropic), openaiBaseUrl (default http://localhost:11434/v1, validated http/https + trailing-slash-stripped, never a path), and six {openai,gemini}Model{Role} strings. Enforced complete by the CODECS mapped type.
• ipc/ai.ts — SECRET_KEYS whitelist + ai:provider:{hasKey,deleteKey,setKey} handlers. Provider is z.enum-validated; only whitelisted keychain secrets are reachable. Legacy anthropic channels kept for back-compat.
• usage.ts — pricingFor prices openai: / gemini:-prefixed models at zero (local/self-hosted has no per-token cost); anthropic pricing unchanged.
• providers/schema.ts (new) — shared toGeminiSchema (uppercase types, strict-hostile keyword pruning, nullable folding) + toOpenAiJsonSchema. gemini.ts slimmed to import + re-export.
• providers/openai.ts — structuredMode: 'json_object' fallback for endpoints without json_schema support; folds the schema into the system prompt. json_schema stays the default.

Tests

Added: openai json_object mode, provider/base-URL prefs validation + coercion, usage zero-pricing. Gate green — typecheck, lint, 797 passed | 1 skipped (baseline 790).

Security

Each provider reads only its own keychain secret via the SECRET_KEYS whitelist; openaiBaseUrl is validated as an http/https URL, not a filesystem path; renderer never supplies keys or paths inline.

🤖 Generated with Claude Code