fix: make translation workflow work without a Copilot plan

[g4bri3lDev]

The scheduled run after #76 merged failed with 403 Forbidden. Everything up to the API call was correct, including finding the 18 new melody strings and chunking them, but the request itself was rejected.

Cause

GitHub Models access is a Copilot entitlement, and a repository GITHUB_TOKEN carries the organisation's entitlement rather than that of whoever triggered the run. This org is on the free plan with 0 Copilot seats, so the built-in token cannot reach GitHub Models however the workflow permissions are set. There is also nothing to switch on: the Models section does not appear in organisation settings at all, because the entitlement is missing.

This was missed because local testing used a personal access token backed by a personal Copilot entitlement. That validated the translation logic but proved nothing about CI, since the two are different identities.

Fix

GitHub Models and OpenRouter speak the same OpenAI-compatible chat/completions shape, so the endpoint, key and model become a small provider table. Whichever API key is present decides which is used:

Variable	Provider
OPENROUTER_API_KEY	OpenRouter. Preferred: no Copilot dependency and no output-token cap.
MODELS_TOKEN	GitHub Models, via a personal access token with models:read.
GITHUB_TOKEN	GitHub Models, only if the repository's organisation has a Copilot plan.

TRANSLATE_PROVIDER and TRANSLATE_MODEL override the choice for one-off runs, which also makes it easy to A/B a cheaper model.

OpenRouter costs roughly $0.12 for a full nine-language backfill. That backfill is already done, so ongoing cost is a fraction of a cent per year.

Also in this PR

• API failures now print the response body and a concrete next step, instead of a bare traceback. That is how this diagnosis took minutes rather than guesswork.
• Drops the models: read permission, which was doing nothing, so the next reader does not assume it is load-bearing.
• The README's translation section keeps user-facing guidance visible and collapses maintainer detail into a dropdown.

Setup

Requires an OPENROUTER_API_KEY repository secret (already added). A repository secret rather than an organisation one keeps it readable only by this repo, and because the workflow is push-triggered rather than pull_request-triggered, fork PRs never receive it.

Verification

• Provider resolution across 6 environment combinations, including the TRANSLATE_PROVIDER and TRANSLATE_MODEL overrides.
• Live end-to-end run through the github provider.
• The no-key error path.
• verify_translations.py still passing on all 9 languages.