feat: add OpenRouter OAuth PKCE authentication

[Void-n-Null]

Closes #7766

Summary

Add support for authenticating with OpenRouter using OAuth PKCE flow, allowing users to log in with their OpenRouter account instead of manually entering an API key.

Changes

• Add OpenRouterAuthPlugin in packages/opencode/src/plugin/openrouter.ts
• Register plugin in INTERNAL_PLUGINS array
• Add hint text for OpenRouter in provider selection

Implementation

The plugin follows the same pattern as CodexAuthPlugin:

1. Starts a local HTTP server on port 3000 to receive the OAuth callback
2. Generates PKCE code verifier and challenge (S256)
3. Opens browser to OpenRouter authorization URL
4. Exchanges authorization code for API key via POST to /api/v1/auth/keys
5. Stores the key as type: "api" (OpenRouter returns a permanent API key, not refresh tokens)

Reference: https://openrouter.ai/docs/guides/overview/auth/oauth

Testing

1. Run opencode auth login
2. Select OpenRouter
3. Select "OpenRouter Account"
4. Browser opens to OpenRouter authorization page
5. After authorization, callback is received and API key is stored

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

No duplicate PRs found

[Void-n-Null]

I've confirmed this works end to end. The OAuth flow completes successfully, the API key is stored, and requests work with the obtained credentials.

I understand that Zen is the recommended approach for accessing multiple models through a single curated API, and it makes sense as the primary path since the models are tested and benchmarked specifically for coding agents. That said, OpenRouter still has a significant user base who prefer it for various reasons (existing credits, specific model access, etc.), so having OAuth support brings it in line with how other providers handle authentication and improves the overall experience for those users.