feat(llm): add aimlapi.com as an LLM endpoint with partner attribution

[Lookoff-AIMLAPI]

Summary

Makes aimlapi.com a first-class OpenAI-protocol endpoint for EverOS.

EverOS has no LLM provider registry — component/llm/client.py builds one
OpenAI-compatible client from base_url, and everything (OpenRouter, OpenAI,
vLLM, DeepInfra) goes through it. So an aimlapi.com key already worked before
this PR by setting base_url alone. Two things did not:

1. Attribution. aimlapi.com credits the project that sent the traffic only
   when the request carries partner headers. A missing header fails silently —
   the call succeeds and the credit is simply lost.
2. Documentation. The Quick Start reads as though OpenRouter were a
   dependency rather than one choice of endpoint.

1. feat(llm): attribute traffic sent to aimlapi.com — 2d0ace6

New everos/component/utils/attribution.py. Four headers —
X-AIMLAPI-Partner-ID, X-AIMLAPI-Source, HTTP-Referer, X-Title — with
HTTP-Referer/X-Title naming EverOS, not the provider.

The headers are origin-scoped, which is the whole design constraint here:
the same client class talks to every other provider, so the helper parses the
configured base_url and returns {} for any host that is not aimlapi.com.
Matching is on the parsed hostname at a dot boundary, so
api.aimlapi.com.example.net gets nothing. A fresh dict is returned per call;
no shared constant is handed out for mutation.

Wired at all three client construction sites:

Site	Mechanism
component/llm/client.py ([llm] + [multimodal])	LLMConfig.extra = {"extra_headers": ...} — everalgo's OpenAICompatClient splats config.extra into the request, and the openai SDK forwards extra_headers as headers, not body fields. Empty dict for every other provider, so no key is added to the request at all (some upstreams 400 on a null-valued option).
component/llm/openai_provider.py	AsyncOpenAI(default_headers=...), merged into the SDK's own defaults rather than over them.
component/embedding/openai_provider.py	Same.

Tests (25 new): the partner id is asserted against ^part_[A-Za-z0-9]{1,64}$
(a malformed id is accepted by the API and then earns nothing, silently);
every non-aimlapi host — OpenRouter, OpenAI, DeepInfra, a lookalike domain, a
proxy with our host in a query string — must yield an empty mapping; and each
construction site is checked to actually forward them, because a client built
without them still works, just unattributed.

2. docs(config): document aimlapi.com as an LLM endpoint — 81eb32f

docs/configuration.md, config.example.toml, config/default.toml,
templates/env.template (and .env.example, which make docs-check requires
to match the template). The shipped [llm] and [multimodal] model slugs are
already spelled the way aimlapi.com spells them, so this is a base_url + key
change with no model rewriting.

3. chore(aimlapi): fork-only placement — do not send upstream — cb397ff

Leads the README/QUICKSTART Quick Start with aimlapi.com. Separated so it can
be dropped wholesale before the docs commit is offered upstream — picking a
default provider is a maintainer call. EverOS has no provider registry, no
provider list, and no featured-badge convention, so there was nothing to
reorder and no badge mechanism to reuse; the provider-endpoints table in
docs/configuration.md is alphabetical.

Area

• Documentation
• Developer experience

Verification

Baseline (2a3136f, pristine tree):   make ci -> exit 0
  make lint         all gates pass (import-linter 3/3 contracts kept)
  make test         2092 passed
  make integration  183 passed, 7 deselected
  make package      wheel built + import-smoked (everos 1.2.3)

After this branch:                   make ci -> exit 0
  make lint         all gates pass
  make test         2117 passed        (+25 new)
  make integration  183 passed, 7 deselected   (identical)
  make package      wheel built + import-smoked (everos 1.2.3)
  make docs-check   pass
  make check-commits RANGE=origin/main..HEAD   pass

LIVE calls through everos.component.llm (not curl, not a mock), with an
httpx request hook recording what actually went on the wire:

[1] plain chat via get_llm_client()          model openai/gpt-4.1-mini
    content       : 'EverOS memory online.'
    model echoed  : gpt-4.1-mini-2025-04-14
    finish_reason : stop
    usage         : prompt_tokens=16 completion_tokens=5

[2] structured output (beta.chat.completions.parse — the path the
    everalgo extractors use)
    content       : '{"subject":"Ada Lovelace","predicate":"wrote",
                      "obj":"the first algorithm"}'
    parsed        : subject='Ada Lovelace' predicate='wrote'
                    obj='the first algorithm'
    finish_reason : stop

[3] text call via get_multimodal_llm_client()
    model         : google/gemini-3-flash-preview
    content       : 'multimodal client up.'

[5] headers actually put on the wire (authorization dropped):
    {'http-referer': 'https://github.com/EverMind-AI/EverOS',
     'x-aimlapi-partner-id': 'part_everos',
     'x-aimlapi-source': 'agent/everos',
     'x-title': 'EverOS', ...}
    — present on all four requests, chat-completions and beta.parse alike.

Both model ids shipped in the docs (openai/gpt-4.1-mini,
google/gemini-3-flash-preview) pass the catalog id-or-alias check and were
called live. Catalog membership alone is not treated as proof in either
direction: the catalog is known to omit ids that work and to list at least one
that 404s. No model id was removed.

Known limitation — recorded, not papered over

[multimodal] image requests fail against aimlapi.com. everalgo's
ImageUrlInner.detail defaults to None and model_dump() emits it, so every
image part goes out as {"url": ..., "detail": null}, which aimlapi.com rejects:

400  error.details: [{"path": "messages.0.content",
                      "reason": "Invalid input", "code": "invalid_union"}]

Isolated by direct probe with an otherwise identical, valid data-URI image:
detail omitted → 200 'Red'; detail: "auto" → 200 'Red';
detail: null → 400. OpenAI and OpenRouter accept the null. The serialisation
lives in the everalgo dependency, not in this repo, so it is documented rather
than worked around here. Text-only [multimodal] calls are unaffected.

Checklist

• I kept the change scoped to the relevant area.
• I am opening this from a separate branch, not pushing directly to main.
• I updated docs, examples, or setup notes when behavior changed.
• I added or updated tests when the change affects behavior.
• I did not commit secrets, .env files, dependency folders, or generated output.
• Active relative links in Markdown files resolve (make docs-check).

Notes for Reviewers

• The extra_headers-through-LLMConfig.extra route is the only way to attach
  headers without forking everalgo; it is worth a look, since a future
  everalgo release could start validating extra as body-only.
• component/llm/factory.py / OpenAIProvider are currently referenced only by
  their own unit test — the live path is client.py → everalgo.build_client.
  Both were wired anyway so the exported public surface behaves consistently.
• max_tokens does not reliably bound reasoning tokens on every upstream, so it
  should not be presented anywhere as a cost bound. Observed here:
  google/gemini-3-flash-preview with max_tokens: 16 returns HTTP 200 whose
  choices[0] has no message key at all (only finish_reason: "length"),
  and a usage object with no completion_tokens. everalgo's _chat_create
  guards choices being empty but not a choice without a message.

By submitting this pull request, I agree that my contribution is licensed under
the Apache License 2.0.