feat(providers): OpenAI + Gemini detection and OpenAI-compatible call path

[CodeWithJuber]

What & why

Implements the ROADMAP "Next" item "OpenAI + Gemini provider detection": extend autoDetectProvider() beyond Anthropic/OpenRouter/LiteLLM to OpenAI and Gemini, with the same zero-config contract. Anthropic credentials still win when present; OPENAI_API_KEY and GEMINI_API_KEY (or GOOGLE_API_KEY) are picked up as the zero-config fallback when they're the only key set.

Detection alone would be hollow — src/llm.js only spoke the Anthropic Messages wire format, so a detected OpenAI key had nothing to call. Both OpenAI and Gemini expose an OpenAI-compatible chat/completions surface, so this adds that wire format alongside the Anthropic one, making a native key genuinely callable.

• src/providers.js — openai and gemini built-in providers (tier→model maps, format: "openai"); new detection branches, listDetectedProviders() entries, and providerStatus() envScan keys.
• src/llm.js — OpenAI-compatible child runner beside the Anthropic Messages one; resolveHttpProvider() now returns a format field and resolves OpenAI/Gemini keys. FORGE_MODEL is honored on the direct-HTTP path too.
• Docs — GUIDE detection chain + env-var table, CHANGELOG.md [Unreleased], ROADMAP.

Checklist

• npm test passes (Node 18/20/22) — 678 tests, 676 pass, 0 fail (2 pre-existing skips); 12 new cases
• npm run check passes (Biome lint + format) — exit 0
• New public functions have a test
• Conventional commit message (feat:)
• CHANGELOG.md updated under ## [Unreleased]
• No new runtime dependency (dev deps ok) — zero deps, stdlib only
• Substrate/docs updated — GUIDE env contract + detection order reconciled (forge docs check green)

Risk & rollback

• Risk level: low — additive; Anthropic path and precedence unchanged (Anthropic still wins when its creds are present), covered by hermetic env tests.
• Rollback plan: revert the commit; no data/schema/config migrations, no persisted state touched.

Extra checks

• npm run typecheck passes (tsc checkJs)
• Input validated at boundaries; errors handled — no-credentials returns null; HTTP non-2xx surfaces an error, no swallowing
• Logs contain no secrets/PII — the key still travels only via the child's _FORGE_LLM_KEY env, never argv/stdout
• If AI-assisted: verified the OpenAI-compatible chat/completions shape for both vendors; behavior is unit-tested (network calls excluded)

🤖 Generated with Claude Code

---

Generated by Claude Code