bifrost: route every provider through the gateway, fall back per VK grant (aieo 0.1.38)

[Evanfeenstra]

Summary

Follow-up to #5296, which granted xai on VKs but deliberately left the xai/ bypasses in place. This removes them and opens the canvas agent's Anthropic-only gate, so all five providers ride Bifrost on every call site. Needs aieo 0.1.38.

• Bypasses removed in src/services/task-workflow.ts and src/app/api/agent/route.ts. Both already passed the model through; nothing else changes there.
• Canvas agent (src/lib/ai/runCanvasAgent.ts) calls the orchestrator for every provider and hands it the resolved model, so baseUrl gets the provider suffix (/openai/v1 for openai / openrouter / xai, /genai/v1beta for google). aieo 0.1.38 prefixes OpenRouter ids with openrouter/ on the gateway path (google and xai already did); Bifrost routes on that prefix and defaults to OpenAI without it, so Kimi-through-gateway would otherwise have 404'd at OpenAI.
• Grant-aware fallback. The reconciler snapshots the VK's provider grants on WorkspaceMember.bifrostVkProviders (new column + migration) and reports modelProvider / providers / modelProviderGranted. The orchestrator returns undefined when the snapshot says the model's provider isn't granted (a swarm whose gateway has no XAI_API_KEY yet), so the caller keeps its direct key instead of sending a call the gateway would reject — nothing downstream retries. Unknown grants (empty snapshot: rows from before the column, or an unreadable gateway) fail open exactly as before.
• Faster convergence. The cached path still re-checks grants once per 24h, but a miss (requested provider absent from the snapshot, or no snapshot) re-checks after 15 min (BIFROST_VK_PROVIDER_MISS_REFRESH_MS), so a gateway that just gained xai flips its cached VKs in minutes. A refresh only overwrites the snapshot when it actually observed the VK.
• AIEO_TO_BIFROST_PROVIDER maps aieo prefixes to Bifrost provider ids (google → gemini), typed against aieo's Provider union so a new aieo provider fails to compile here until it's mapped.
• Drive-by: two pre-existing lint warnings in touched files cleared (unused value import in the orchestrator, unused start in the canvas agent).

Not in this PR: the canvas agent still falls back to Anthropic when Hive itself lacks the provider's env key — hasApiKeyForProvider runs before Bifrost is consulted. Hive holds all five keys today, so no behaviour change, but Bifrost routing doesn't yet remove that dependency. Whether the Stakwork worker and goose forward the prefixed model id unchanged is on their side.

Test plan

• npx vitest run src/__tests__/unit/services/bifrost/ — 165 passing (48 in reconciler.test.ts incl. 8 new grant-snapshot cases; 24 in orchestrator.test.ts incl. 3 new fallback cases)
• planner / canvas-agent / agent-route / stakwork-run unit suites — 490 passing
• TEST_SUITE=integration reconciler integration test against the migrated test DB — 2 passing
• npx eslint --max-warnings=0 on every changed file
• npx tsc --noEmit — no errors in changed source files (only the repo's pre-existing dbMock typing noise on test lines)
• Migration created with npx prisma migrate dev (20260910203512_add_workspace_member_bifrost_vk_providers)
• Swarm whose gateway has xai: a Grok run logs [callStakworkAPI] model routing with bifrostActive: true and a baseUrl ending in /openai/v1, and the request shows on the gateway under the member's VK
• Swarm whose gateway lacks xai: Bifrost VK has no grant for the model's provider; falling back to direct key is logged and the run completes on XAI_API_KEY
• Canvas agent with an openrouter/* preference: the gateway sees model openrouter/<id> on /openai/v1