Add OpenRouter authentication diagnostics

internal/llm/http_evidence.go

@@ -6,6 +6,8 @@ import (
 	"net/http"
 	"sync"
 	"time"
+
+	"gitea.maximumdirect.net/eric/promptkit/internal/domain"
 )
 
 // HTTPExecutionEvidence contains only facts observable at the configured
@@ -99,6 +101,27 @@ func (c *OpenAICompatibleClient) GetWithEvidence(
 	ctx context.Context,
 	endpoint string,
 	timeoutSeconds int,
+) (*http.Response, HTTPExecutionEvidence, error) {
+	return c.getWithEvidence(ctx, endpoint, timeoutSeconds, "")
+}
+
+// GetWithAuthenticationEvidence performs a plain GET with credentials resolved
+// from the selected target. Missing credentials are allowed for diagnostic
+// authentication probes even when generation requires a key.
+func (c *OpenAICompatibleClient) GetWithAuthenticationEvidence(
+	ctx context.Context,
+	endpoint string,
+	timeoutSeconds int,
+	target domain.ExecutionTarget,
+) (*http.Response, HTTPExecutionEvidence, error) {
+	return c.getWithEvidence(ctx, endpoint, timeoutSeconds, resolveAPIKey(target))
+}
+
+func (c *OpenAICompatibleClient) getWithEvidence(
+	ctx context.Context,
+	endpoint string,
+	timeoutSeconds int,
+	apiKey string,
 ) (*http.Response, HTTPExecutionEvidence, error) {
 	requestContext := ctx
 	var cancel context.CancelFunc
@@ -113,6 +136,9 @@ func (c *OpenAICompatibleClient) GetWithEvidence(
 		}
 		return nil, HTTPExecutionEvidence{}, err
 	}
+	if apiKey != "" {
+		request.Header.Set("Authorization", "Bearer "+apiKey)
+	}
 
 	response, err, evidence := doWithEvidence(c.httpClient, request)
 	if response == nil || response.Body == nil {