feat(llm): complete gated OpenAI-compatible HTTP provider

[andriypolanski]

Summary

Complete the optional OpenAI-compatible provider with a real HTTP/HTTPS transport, runtime credential checks, and fail-closed gate behavior. Add loopback wire tests and deployment documentation so the remote path is usable without changing the local runtime default.

Closes #795, #569

Changes

• Implement OpenAI-compatible chat completions over reqwest, including JSON and SSE streaming responses.
• Preserve configured base paths when joining chat/completions and reject non-HTTP(S) schemes.
• Reuse the shared OpenAI request serialization and response-error helpers while leaving the local raw TCP client unchanged.
• Resolve and validate bearer credentials from the configured environment variable on every request.
• Make provider readiness fail closed when credentials are missing, empty, removed, or invalid for an HTTP header.
• Sanitize and truncate upstream diagnostics without exposing credential values.
• Add loopback wire tests for gate behavior, request shape, streaming, URL handling, readiness transitions, and secret redaction.
• Document configuration, remote opt-in, credential requirements, and runtime failure behavior in the deployment templates and configuration guide.

Real Behavior Proof

• I have built and run the affected code locally (or noted why I could not).
• I have verified the change end-to-end on Jetson hardware.
• I have NOT verified on Jetson hardware, and I explain the equivalent verification path or validation gap below.

Tested profile / hardware (check all that apply):

• jetson
• raspberry_pi
• portable_sbc
• laptop
• mac
• CI-only / docs-only
• Not run locally

What I ran

Linux x86_64 laptop, Rust 1.97.1. Jetson hardware was not available:

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --locked --all-targets
cargo test --workspace --locked --doc

cargo clippy \
  -p genie-core -p genie-ctl \
  --no-default-features --all-targets --locked \
  -- -D warnings
cargo test \
  -p genie-core -p genie-ctl \
  --no-default-features --all-targets --locked

cargo test -p genie-core \
  --test provider_test \
  --test provider_config_test

What I observed

• Formatting and workspace clippy passed with warnings denied.
• All workspace targets and doc tests passed.
• The genie-core and genie-ctl no-default-features clippy and test axis passed.
• Focused provider tests passed: 7 provider_test tests and 8 provider_config_test tests.
• Loopback tests observed zero network calls with the gate disabled and exactly one call when enabled.
• Captured requests contained the expected /v1/chat/completions path, bearer authorization, model, messages, token budget, response format, and stream flag.
• Removing the configured key after startup changed readiness and failed before connection.
• JSON and SSE responses completed successfully, while a fake credential embedded in an upstream error was absent from the returned error.

This was not run against a real remote provider or on Jetson hardware because neither was available. The loopback server exercises the same HTTP request/response boundary without sending data or requiring a real credential. It does not verify provider-specific compatibility, public TLS, Jetson networking, or aarch64 execution; those remain validation gaps for reviewer or CI follow-up.

Test plan

1. Configure an optional OpenAI-compatible endpoint with a /v1 base path, model, credential environment-variable name, and the required remote-provider opt-in.
2. Start with the provider gate disabled and confirm requests continue through the local provider.
3. Enable the optional-provider gate and send both non-streaming and streaming chat requests.
4. Confirm the remote endpoint receives bearer authentication and the configured model/request fields.
5. Remove or empty the credential environment variable while the process is running and confirm the next request is refused before network access.
6. Restore the credential and confirm provider readiness and requests recover without restarting.
7. Return a non-success response containing the credential and confirm the surfaced error retains useful status information without exposing the secret.

Notes for reviewers

• The optional provider remains disabled by default; the local Genie runtime remains the default path.
• Remote endpoints still require explicit opt-in because prompts and conversation content leave the device.
• Credential values are not cached. This intentionally makes readiness and each request reflect runtime secret rotation or removal.
• The reqwest stream feature adds the expected transitive lockfile entries used by streaming response bodies.
• No external service or real API key is used by the tests.

[matedev01]

LGTM — completes the optional OpenAI-compatible provider with a real reqwest-based HTTP/HTTPS transport (JSON + SSE streaming), leaving the local raw TCP client untouched. Verified independently, not just from the PR description: resolve_bearer_token re-reads the env var fresh on every request (not cached at startup) so revoking a credential takes effect immediately; parse_openai_compatible_base_url rejects non-HTTP(S) schemes with a test; error paths route through sanitize_error_detail/redact_reqwest_error and Debug redacts the literal-credential variant, all with dedicated tests. Only dependency change is enabling reqwest's existing 'stream' feature, no new crate. Closes #795, part of #569 (M2-C). Off by default, no change to the local provider path. Verified: clippy -D warnings clean, provider tests (15) pass, fmt clean.