refactor(providers): unify provider management on litellm

[0xKT]

Summary

Provider management used to be a whitelist: a registry of 21 vendors that
decided who could be configured at all, plus a second execution path that
bypassed LiteLLM entirely for knn routing. This makes LiteLLM the single
execution layer and reduces the registry to what LiteLLM cannot tell us.

knn routing now runs on LiteLLM. It needed several endpoints alive in one
process, which CustomProvider provided by talking to the endpoints directly --
at the cost of native streaming, retries and tool-calling. PerModelProvider
now builds one LiteLLMProvider per endpoint instead, and custom_provider.py
is deleted. knn is a decision layer again; execution is LiteLLM everywhere.

Any vendor LiteLLM supports is now configurable. A key under the vendor's
name plus a <vendor>/<model> id is enough -- 134 vendors instead of 21, with
no registry entry required. provider list, raven status, the startup gate
and the TUI model picker all report them, which they previously could not: a
working setup read as unconfigured, so Raven kept pushing the user into a wizard
that then refused to configure that vendor. Names LiteLLM has never heard of are
still rejected as typos, and a typo no longer makes Raven unstartable.

A provider now has one name. It used to have two -- ours and LiteLLM's --
reconciled by a litellm_prefix field read at every site that compared a name
or a model-id prefix. That field conflated two opposite facts: LiteLLM spelling
the same vendor differently (vllm -> hosted_vllm) versus a provider reached
through another vendor's driver (SiliconFlow over OpenAI's API). "Is this prefix
mine?" has opposite answers for the two, and deriving the distinction from
whether the prefix happened to be another entry's name was correct only by
coincidence. LiteLLM's spelling is now the provider's own name, litellm_prefix
is gone, and only a borrowed driver states via_driver -- which is absent from
route_names by construction, so an id asking for openai/ can no longer be
answered with SiliconFlow's key. zhipu is renamed to zai on the same basis.

Four facts were each implemented at several call sites and had already drifted
apart -- how a model id splits into a prefix, how a name is spelled for
comparison, which names refer to a provider, and how a provider's config
section is found. Each now has exactly one implementation, in registry.py or
ProvidersConfig.get.

Credential routing

Several paths could hand one vendor's key to another. All are fixed here:

• a gateway's model prefix was read from the raw field rather than the derived
  one, so a gateway whose name is already LiteLLM's declared nothing and the
  prefix was dropped -- sending the gateway's key to the vendor named in the
  model id;
• an explicit prefix could be overridden by a keyword match, so
  deepinfra/deepseek-ai/DeepSeek-V3 put DeepInfra's key in DEEPSEEK_API_KEY
  and rewrote the model id;
• a bare id naming an unconfigured vendor fell back to any credentialed direct
  vendor, e.g. a lone Anthropic key answering for kimi-k2.5;
• environment variables were derived from LiteLLM's validate_environment, so
  the key was written into every variable it listed --
  AWS_SECRET_ACCESS_KEY for Bedrock, CLOUDFLARE_API_BASE for Cloudflare;
• litellm.api_base was set process-wide, leaking one provider's endpoint to
  every other call in the process;
• the OpenRouter shortlist offered bare anthropic/... ids, which
  auto-detection reads as a request for that vendor direct, quietly leaving
  OpenRouter as soon as the user also held that vendor's key;
• a routing.models entry without an api_base fell through to
  OPENAI_BASE_URL or api.openai.com, shipping the prompt and that
  endpoint's key to a third party; it now raises.

There is no attacker model here -- these are misrouting bugs, not an
authentication bypass -- but each one sends a credential somewhere its owner did
not intend, so they are called out rather than folded into the summary.

Also fixed

• an empty declared section no longer answers for a provider, so credentials
  written under one of its other names are not shadowed by a placeholder;
• differently-spelled sections (azure-openai, OpenRouter, nanoGpt) resolve
  to the same provider on both the read and the write path, so a section written
  as LiteLLM spells it is no longer invisible to provider get/set and a write
  no longer leaves two sections for one provider;
• _litellm_knows returns three states instead of raising, because only one of
  its five call sites caught the exception;
• the onboard wizard no longer drops api_key / api_base for vendors with no
  registry entry, and no longer overwrites a real key with None when a
  re-configure is abandoned;
• raven status reads credentials from the loaded config, so ones supplied by
  environment variable are visible, and an OAuth provider without a token
  reports "not set" rather than a checkmark.

New

agents.defaults.modelOverrides lets a user override request params per model,
which previously only the registry could do. knn-routed models inherit it, so a
routed model behaves like the default provider.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

uv run --all-extras pytest -q          # 4869 passed, 30 skipped, 0 failed
uv run ruff check raven/ tests/ benchmarks/
uv run ruff format --check raven/ tests/ benchmarks/

79 new tests across five files. The provider-resolution suite is sweep-shaped:
each invariant runs over every registered provider rather than the case that was
last fixed, since the drift this PR removes was invisible to case-shaped tests.
Every assertion was checked by breaking the implementation and confirming it
goes red.

It also carries five source guards against a second implementation reappearing.
These are line scans -- tripwires, not proofs. A deliberate rewrite walks past
them; what they catch is the shape that actually recurred, the same spelling
copied to a new call site.

Behaviour was compared against the base branch over a matrix of provider
configurations, model-id shapes and forced-provider settings. Every difference
falls into one of the intended changes below.

• Relevant tests pass locally
• Relevant lint / type checks pass locally
• User-facing docs or screenshots are updated when needed

Risk

Three user-visible behaviour changes:

1. A user whose only credentials are direct vendors -- no gateway -- and whose
   default model carries another vendor's prefix now gets "provider not
   configured" instead of a downstream 401. Anyone holding a gateway key is
   unaffected: a gateway legitimately routes any id.
2. The canonical section names for vLLM and Ollama become hosted_vllm and
   ollama_chat, LiteLLM's own spellings. Existing configs keep loading under
   the old names; the next provider set consolidates onto the new one.
3. A routing.models entry without an api_base now raises instead of
   silently defaulting to api.openai.com.

Rollback is a revert: no data migration runs, and configs written before this
change continue to load unchanged.

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Related Issues

Fixes #242
Fixes #243
Fixes #244
Fixes #245
Fixes #246