feat(wrapper): hybrid mode — route known provider prefixes through wrapper alongside decision_api

[levleontiev]

Context

PR #40 implements FAIRVISOR_MODE=wrapper (dedicated wrapper mode). Spec 019 also specifies a hybrid mode where the edge runs both decision enforcement AND LLM proxy routing simultaneously: requests to known provider prefixes (/openai, /anthropic, etc.) are handled by wrapper.access_handler(); all other requests fall through to decision_api.access_handler().

This was scoped out of PR #40 to keep the initial implementation focused. Tracked here per agreed scope cut.

What needs to change

• src/nginx/access.lua: when mode == "hybrid", call wrapper.get_provider(path) — if a provider matches, call wrapper.access_handler(); otherwise fall through to decision_api.access_handler()
• docker/entrypoint.sh: add hybrid to allowed FAIRVISOR_MODE values
• bin/ci/validate_nginx_template.sh: test with FAIRVISOR_MODE=hybrid as well
• BDD scenario: hybrid mode routes /openai/... through wrapper and /v1/decision through decision_api

Acceptance criteria

• FAIRVISOR_MODE=hybrid accepted by entrypoint.sh
• /openai/* requests in hybrid mode hit wrapper.access_handler()
• Non-provider paths in hybrid mode hit decision_api.access_handler()
• Unit test coverage

Related: #39, PR #40