Add OpenRouter authentication diagnostics

internal/llm/openai_compatible_client.go

@@ -164,11 +164,8 @@ func (c *OpenAICompatibleClient) PrepareGeneration(req domain.GenerateRequest) (
 		}
 		return nil, fmt.Errorf("%w: failed to encode request: %v", ErrRequestFailed, err)
 	}
-	apiKey := strings.TrimSpace(req.Target.APIKey)
+	apiKey := resolveAPIKey(req.Target)
 	envName := strings.TrimSpace(req.Target.APIKeyEnv)
-	if apiKey == "" && envName != "" {
-		apiKey = strings.TrimSpace(os.Getenv(envName))
-	}
 	if apiKey == "" && req.Target.APIKeyRequired {
 		if envName != "" {
 			return nil, fmt.Errorf("%w: api key environment variable %q is not set", ErrInvalidRequest, envName)
@@ -186,6 +183,16 @@ func (c *OpenAICompatibleClient) PrepareGeneration(req domain.GenerateRequest) (
 	}, nil
 }
 
+func resolveAPIKey(target domain.ExecutionTarget) string {
+	apiKey := strings.TrimSpace(target.APIKey)
+	if apiKey == "" {
+		if envName := strings.TrimSpace(target.APIKeyEnv); envName != "" {
+			apiKey = strings.TrimSpace(os.Getenv(envName))
+		}
+	}
+	return apiKey
+}
+
 // Execute dispatches one attempt. The returned response is non-nil only when
 // the successful envelope contains a usable first choice.
 func (p *PreparedGeneration) Execute(ctx context.Context) AttemptOutcome {