feat(provider): route the managed wallet through OpenRouter only (#110)

When the LLM spend toggle is explicitly "managed", wallet inference now
flows through OpenRouter exclusively — the first-party managed proxies
(anthropic / openai / google), which openscience had fanned the wallet
across via managedProxyKey, are taken out of the managed path. OpenRouter
is the one gateway with a single unified reasoning stream, so this both
implements "wallet ⇒ OpenRouter, no other providers" and sets up the
reasoning-trace fix (follow-up PR).

Two pure helpers gate everything:
- managedRoutesOpenRouterOnly(config): true only for billing.llm==='managed'.
- managedProviderAllowed(id): openrouter + the hosted synsci demo.

Wired into (1) managedProxyKey — never attach the thk_ wallet token to a
first-party proxy; and (2) isProviderAllowed — drop non-OpenRouter/non-synsci
providers from a managed session, which transitively makes defaultModel()
and getSmallModel() OpenRouter-only (they read the filtered state).

BYOK and the legacy auto-detect path (billing.llm unset/null/'byok') are
untouched — the existing managed-proxy-forwarding tests, which never set
the toggle, still pass. pinByokToPublicEndpoint and the managed-key sanity
check are unchanged.