feat(providers): add Cloudflare, Groq, Mistral, OrcaRouter and xAI providers

[Glen-SP]

Summary

Adds five model providers — Cloudflare Workers AI, Groq, Mistral, OrcaRouter and
xAI — as first-class plugins, with the runtime and credential wiring each needs to
work through praxist configure-llm. Two defects found during validation are
fixed here: groq_alias was structurally unusable, and xai_alias shipped
retired models.

Scope

• Affected modules or public contracts: five new plugins under
  praxist/plugins/model_providers/, plus praxist/core/{cloudflare,credentials, modeling,redaction}.py, praxist/cli/{_env,_setup_common,setup,start}.py,
  codex_sdk/{_relay,adapter}.py, and research_loop/{provider_env,startup, stage}.py. normalize_model_for_provider gains one exempt api_format.
• Compatibility considerations: existing providers are untouched in behavior;
  the groq api_format is new, so no previously valid configuration changes
  meaning. Docs and skills updated alongside.
• Task-agnostic rationale: provider selection is orthogonal to any task's metric
  or protocol; these are transport and credential concerns only.

Verification

Each plugin's declared default_model was checked against the vendor's live
catalog (GET /models), then with a 1-token chat call. This is the check the test
suite cannot perform — to pytest, a model name is just a string.

Provider	Declared default_model	Reachable
openrouter	anthropic/claude-opus-4.7	yes
mistral_alias	mistral-large-latest	yes
cloudflare	@cf/deepseek-ai/deepseek-v4-flash-0731	yes
orcarouter	orcarouter/auto	yes
groq_alias	llama-3.3-70b-versatile	no — defect 1, fixed
xai_alias	grok-2-latest	no — defect 2, fixed

Defect 1 — groq_alias could not route. All three declared models returned
404; Groq's catalog no longer carries a Llama chat model. A rename was not enough:
under api_format: openai_compatible the vendor/ prefix was stripped before
startup.py validated the name against compatible_model_patterns, so no model
in the catalog both survived normalization and passed validation. Fixed with a
dedicated groq api_format exempt from stripping, mirroring how
cloudflare_workers_ai already handles its @cf/vendor/model IDs.

Defect 2 — xai_alias declared retired models. grok-2-latest and
grok-2-mini no longer exist; the live catalog is grok-4.x. Config-only fix:
grok-4.6 for default_model and strong_reasoner,
grok-4.20-0309-non-reasoning for cheap_peer.

Integration test — Praxist's own resolution chain. Raw HTTP proves the vendor
works, not that the plugin wiring does. This drove plugin.yaml →
provider_upstream() → provider_key_var() → live call, the path a real
praxist configure-llm --provider X takes. All six providers resolved and
returned 200.

Checklist

• The change is focused and does not include unrelated generated files.
• Tests cover the affected behavior.
• Documentation, templates, examples, and skills were updated where needed.
• No credentials, private task data, or research-run artifacts are included.
• New dependencies and copied assets include their source and license terms.
• I have read .github/CONTRIBUTING.md and the contribution terms in LICENSE.md.