feat: worker credential routing and custom upstream (#482)

## Summary

Adds independent configuration for background worker LLM calls
(distillation, curation, consolidation, query expansion). Workers can
now use a different API key, upstream URL, and model than the session's
client — enabling setups like "foreground uses Anthropic Opus,
background uses MiniMax" without code changes.

Motivated by Onur's MiniMax integration: background workers inherit the
session's Anthropic key, which 401s at MiniMax. This PR solves the
credential routing gap documented in the "Gateway auth: single
credential per session" architecture entry.

## New Environment Variables

| Env Var | Purpose | Example |
|---|---|---|
| `LORE_WORKER_API_KEY` | Standalone API key for worker calls. Workers
use this instead of the session's credential. |
`<minimax-token-plan-key>` |
| `LORE_WORKER_UPSTREAM` | Custom upstream URL for worker HTTP calls.
All workers route here instead of default upstreams. |
`https://api.minimax.io/anthropic` |
| `LORE_WORKER_MODEL` | Override worker model name. Highest priority in
the resolution chain. Format: `modelID` or `providerID/modelID`. |
`MiniMax-M2.7` or `anthropic/MiniMax-M2.7` |

## Onur's MiniMax Setup

With these env vars, Onur's configuration becomes:
```bash
export LORE_WORKER_API_KEY="<minimax-key>"
export LORE_WORKER_UPSTREAM="https://api.minimax.io/anthropic"
export LORE_WORKER_MODEL="MiniMax-M2.7"
```

Result: background workers always authenticate with the MiniMax key and
route to MiniMax's endpoint, regardless of whether the foreground
session is using Opus or MiniMax.

## Design

The implementation leverages the existing dependency injection
architecture — `getAuth` and `upstreams` are already injected as
callbacks/objects at client construction time. The single construction
site (`getLLMClient()` in pipeline.ts) is the only place that needed
modification:

- **`config.ts`**: Added `workerApiKey?` and `workerUpstream?` to
`GatewayConfig`
- **`pipeline.ts`**: In `getLLMClient()`, computes `getWorkerAuth`
callback and `workerUpstreams` object, passes them to both
`createGatewayLLMClient()` and `createBatchLLMClient()`
- **`worker-model.ts`**: In `getWorkerModel()`, checks
`LORE_WORKER_MODEL` env var before config-file and cost-aware defaults

Zero changes in `@loreai/core`, `auth.ts`, `llm-adapter.ts`,
`batch-queue.ts`, or `idle.ts`.