Bring-your-own keys for cloud providers (OpenAI-compatible)

Settings -> Providers takes keys for OpenAI, Anthropic (their official
OpenAI-compatibility layer), DeepSeek, Groq, OpenRouter and any custom
OpenAI-compatible endpoint. One adapter (lib/openai-compat) covers
listing, streaming chat, JSON generation and vision, and every model
flow can run on a provider: the chat picker lists each enabled
provider's models (labelled, remembered), and a "Study generation"
choice moves decks, homework, grading and attachment transcription onto
a provider model.

Keys stay in this browser exactly like the Ollama one
(freezmo.providers.v1): never stored server-side, never in a backup or
the sync payload, forwarded only with the request that needs them. The
provider test asserts the key reaches the provider while the routing
header stays on the app side.

New suite tests/providers-test.mjs (13 checks) stubs both protocols:
model listing, chat streaming, study generation and the Settings flow.
Privacy policy updated (en+cs). Contrast 0 findings, axe clean, mobile
126/126, chat 102/102, wizard 95/95, bubbles 34/34, regression 44/44,
i18n 13/13, native 33/33. Version 0.4.7, SW -> freezmo-v72.

lib/providers-server.ts

@@ -0,0 +1,88 @@
+/**
+ * Resolves where a model call should go: the server's Ollama (as before) or a
+ * cloud provider the browser sent a key for. Shared by the model routes so
+ * every flow (chat, decks, homework, grading) can run on either backend.
+ */
+
+import { authErrorMessage, authErrorKind, resolveAuth, type OllamaAuth, type ServerConfig } from "./config";
+import { sanitiseApiKey } from "./http-guard";
+import { PROVIDER_BASE_HEADER, PROVIDER_HEADER, PROVIDER_KEY_HEADER, providerInfo } from "./providers";
+import type { ProviderTarget } from "./openai-compat";
+import type { Locale } from "./i18n-dict";
+
+export type ModelTarget =
+  | { kind: "ollama"; auth: OllamaAuth }
+  | { kind: "provider"; provider: string; label: string; target: ProviderTarget };
+
+export type TargetResolution =
+  | { target: ModelTarget }
+  | { error: { message: string; kind: string; status: number } };
+
+/**
+ * Inert credentials for provider runs: the ai.ts helpers still take an
+ * `auth`, but it is never used once a provider target is set.
+ */
+export const INERT_OLLAMA_AUTH: OllamaAuth = { baseUrl: "", apiKey: "", directCloud: false, authMode: "local" };
+
+function safeBase(raw: string): string | null {
+  const value = raw.trim().slice(0, 300);
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    if (!url.hostname) return null;
+    return value.replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+
+export function resolveModelTarget(config: ServerConfig, request: Request, locale: Locale): TargetResolution {
+  const requested = (request.headers.get(PROVIDER_HEADER) ?? "ollama").trim().toLowerCase();
+
+  if (!requested || requested === "ollama") {
+    const auth = resolveAuth(config, request);
+    if ("error" in auth) {
+      const kind = authErrorKind(auth.error);
+      return { error: { message: authErrorMessage(locale, auth.error), kind, status: kind === "needs_key" ? 401 : 500 } };
+    }
+    return { target: { kind: "ollama", auth: auth.auth } };
+  }
+
+  const info = providerInfo(requested);
+  if (!info) {
+    return { error: { message: `Unknown model provider "${requested}".`, kind: "bad_provider", status: 400 } };
+  }
+
+  // A browser-saved key is the point of providers: the server never holds it.
+  const apiKey = sanitiseApiKey(request.headers.get(PROVIDER_KEY_HEADER) ?? "");
+  if (!apiKey) {
+    return {
+      error: {
+        message: `Add your ${info.label} API key in Settings → Providers.`,
+        kind: "needs_key",
+        status: 401,
+      },
+    };
+  }
+
+  const baseUrl = requested === "custom" ? safeBase(request.headers.get(PROVIDER_BASE_HEADER) ?? "") : info.baseUrl;
+  if (!baseUrl) {
+    return {
+      error: {
+        message: `Add the base URL for your custom OpenAI-compatible endpoint in Settings → Providers.`,
+        kind: "bad_provider",
+        status: 400,
+      },
+    };
+  }
+
+  return {
+    target: {
+      kind: "provider",
+      provider: requested,
+      label: info.label,
+      target: { baseUrl, apiKey, label: info.label },
+    },
+  };
+}