fix(api): autoDetectProvider prioritizes openrouter over openai

AUTO_DETECT_ORDER listed openai before openrouter, but both the
function's documented priority comment and the provider-defaults.test
assertion "prefers openrouter over openai when both are set" pin the
opposite order. The probe array had drifted from the stated design,
so any call site that auto-detected a provider with both keys present
silently picked openai and never went through the OpenRouter
aggregator the user configured.

Fix: move the OPENROUTER_API_KEY probe to the head of the array.
Matches the // Priority: openrouter → openai → anthropic → … comment
directly above the function definition. Aligns with user intent —
keys for an aggregator plus a direct provider usually mean "route
through the aggregator for failover / cost / pooling".

Also fixes one of two pre-existing CI failures on the AgentOS test
suite. 19/19 provider-defaults tests now pass. Second pre-existing
failure (generateImage Replicate body.version resolution) left to a
dedicated session — deeper trace through the image-provider chain.

Author: jddunn

src/api/runtime/provider-defaults.ts

@@ -116,9 +116,15 @@ type AutoDetectProbe =
  * the requested task type, so the order matters most for the default (text) case.
  */
 const AUTO_DETECT_ORDER: AutoDetectProbe[] = [
+  // OpenRouter first: users who set OPENROUTER_API_KEY alongside a
+  // direct-provider key typically intend the OpenRouter aggregator
+  // to mediate (failover, cost routing, etc.). Matches the documented
+  // priority comment below and the provider-defaults.test.ts pin that
+  // "openrouter wins when both OPENROUTER_API_KEY and OPENAI_API_KEY
+  // are set".
+  { envKey: 'OPENROUTER_API_KEY', provider: 'openrouter' },
   { envKey: 'OPENAI_API_KEY', provider: 'openai' },
   { envKey: 'ANTHROPIC_API_KEY', provider: 'anthropic' },
-  { envKey: 'OPENROUTER_API_KEY', provider: 'openrouter' },
   { envKey: 'GEMINI_API_KEY', provider: 'gemini' },
   { envKey: 'GROQ_API_KEY', provider: 'groq' },
   { envKey: 'TOGETHER_API_KEY', provider: 'together' },