feat(providerroutes): expand the vendor table 23 → 50 rows, with fences that can go red

[damonleelcx]

Part of provider-credential-cascade (6 coordinated PRs — see the list at the bottom).

Why

The credential dialog carried a hand-written provider list that had drifted nine entries from this table. Expanding the table is only half the fix; the other half is making that drift impossible to reintroduce silently.

What

Rows — the anthropic second face for deepseek / moonshot / qwen / doubao / minimax / zhipu(z.ai), plus eleven new openai-compatible vendors. Only-add: the 23 existing rows are byte-identical apart from one default: true that I-5 requires.

Fences — each was deliberately broken once and observed red; the actual failure text is in fence-proof.md:

	Invariant	Note
I-3	baseline round-trip, frozen before the expansion	asserts "the row this URL resolves to has not CHANGED", not "resolves to ITSELF" — two rows are deliberate alias rows, and a self-hit assertion would fail on real behaviour then get "fixed" into a whitelist exception
I-4	segment-aligned longest prefix	auto-discovers containment pairs (11 today) rather than whitelisting them
I-5	every (provider, protocol) resolves	its failure mode is a silently blank URL box, not an error
I-6	every routed provider has a registry identity	🔴 red on arrival — huggingface, yunwu and zeroeleven had been routed with no identity for months
I-9	no secret-shaped literals, comments included
I-11	the mixed-version difference is enumerated	26 affected rows, 5 of them silent

Two additions worth reviewer attention

LegacyProtocolForProvider — giving five providers a second protocol face falsified the "exactly one declared protocol" fallback that protocol-less legacy credentials resolve through, which would have made every one of them 502. (zhipu had been failing that way since 2026-05, unnoticed, because nothing asserted the property.) The rule is semantic — the protocol of the bare-host rows, which a second face cannot move — not "the first row in YAML order".

PathDiscarded — for R-9. An old proxy silently swallows a path segment it does not recognise, and LookupByBaseURL returns ok=true so the existing WARN never fires. Query only; forwarding is untouched.

Coordinated PRs

• pkg ← this one
• aikey-cli — the yaml source of truth + the Rust half of the same regression
• aikey-control — codegen + the repo's first web CI
• aikey-control-master — the dialog, the combination matrix, a second defect found in the bindings page
• aikey-proxy — the R-9 WARN and the mixed-version replay
• roadmap20260320 — evidence (targets main; that repo has no develop-v1.0.5)

🤖 Generated with Claude Code