feat(llm): add Requesty provider via OpenAI-compatible router

[Thibaultjaigu]

Summary

Adds Requesty (https://router.requesty.ai/v1) as an opt-in LLM provider, following the same footprint as the Novita provider in #155. It goes through the existing OpenAIAdapter, reads REQUESTY_API_KEY, and has a default model, a short model catalog, setup and CLI key entry, the API config panel option, and docs. Requesty is not added to createBestAvailableBackbone or to the opt-in TEMPEST_MODEL_FALLBACK chain, so it is only used when selected.

The Settings model list fetches /v1/models/managed (curated routing ids like claude-sonnet-5) and /v1/models (the full vendor/model catalog) separately, each with its own timeout, so one failing endpoint still leaves the other list. Ids with control characters are dropped. The static catalog ids (anthropic/claude-sonnet-5, openai/gpt-5.4) were checked against the live /v1/models today.

Linked issue

None.

Prior work and attribution

• Prior PR or issue used: notes/reference (feat(llm): add native Novita AI provider via OpenAI-compatible endpoint #155, Novita provider)
• Reused/adapted areas: provider wiring pattern and the backbone test shape from src/__tests__/novita-provider.test.ts
• Fresh verification performed for reused material: all tests rerun on this head, plus a live call

Contribution receipt

• Scope class: local_lab
• Target authority: n/a, LLM provider integration with no target scope involved
• Network use: authorized_external (live call to router.requesty.ai during development only; the shipped tests mock fetch)
• Claims or evidence changed: none
• Redaction/provenance notes: REQUESTY_API_KEY is added to the exportConfig redaction list and covered by api-key-env-static.test.ts

Verification

• npm run typecheck
• npm test
• npm run doctor
• Risk-specific checks are listed below, or not applicable with a reason

Exact commands and results:

• npm run lint: 0 errors (existing warnings only)
• npm run typecheck: pass
• npm test: 90 files, 1001 tests pass, plus the script self-tests pass
• npm run doctor: 29/33 checks, 4 warnings for optional local tools and the offline API, 0 blockers
• Live check through createRequestyBackbone() with openai/gpt-4o-mini returned the expected reply with finishReason: "stop", and listProviderModels('requesty') returned 894 ids keyless and 939 with a key.

Risk and rollback

• Residual risk: low; additive only, no existing provider behavior changes.
• Rollback: revert the three commits.

Delivery checks

• Diff is scoped against current upstream/main
• No unrelated protected evidence, safety tests, or provider/config files were removed
• Published review history was not force-pushed
• Reused or adapted prior work is identified, re-verified, and credited
• Exact-head PR CI is green (including the 50% changed-line coverage floor)
• I understand PR acceptance is not release certification

Disclosure: I work at Requesty. Happy to adjust anything to match project conventions.