feat(settings): add AI Router profiles and attach one per lane

A new **AI Router** tab in Settings, next to Codex, stores named router
endpoints (9Router, OpenRouter, a self-hosted gateway) as profiles: a base
URL, an API key, a default model and an optional per-tier override. The tab
only stores them; a lane CHOOSES one in the Add-lane modal, via a Native /
AI Router radio, and that choice is written into the lane's own config.

The two CLIs are configured differently, and the difference is theirs:

  - a claude lane gets eight `env` keys merged into its own
    `.claude/settings.local.json` (`.local` because the value holds a key);
  - a codex lane gets `$CODEX_HOME/<name>.config.toml` — the layer
    `codex -p <name>` loads — because Codex has NO project-level config.
    Its base `config.toml` is never touched.

Native is a built-in profile rather than a code branch, so "go back to
native" is the same write path. It blanks the two connection variables
instead of removing them (an absent key at project scope lets a USER-level
router apply) and removes the model names instead of writing them (writing
them would override the user's own global model choice).

Key material never leaves the server: profiles live one file each under
`<CLAUDE_HOME>/agenthub-routers/` (0700/0600), `GET /api/ai-routers`
reports only `hasKey`, and there is deliberately no route returning one
profile in full.

Three things this had to get right, each found by review and verified
against the real tools rather than assumed:

  - `wire_api = "chat"` is rejected outright by codex-cli 0.149 ("no longer
    supported"), so every codex lane on a router would have failed to start.
    The layer writes "responses", and writes `env_key` only when the profile
    actually has a key — naming an unset variable is itself a startup error.
  - The key must never be TYPED into a pane. `tmux.sendCommand` used
    `send-keys` with a `KEY='…' cmd` prefix, which the dashboard streams to
    every attached browser and bash appends to history; it now takes over the
    idle pane with `respawn-pane -k -e`, passing env through argv the way
    `newSession` always has. Verified on tmux 3.4: multi-element argv arrives
    intact and the pane renders no trace of the value.
  - Attaching COPIES a profile, so editing or deleting one in Settings has to
    reach the lanes already using it. An edit re-applies it (a rotated key
    would otherwise never reach the lane still holding the revoked one); a
    delete resets those lanes to native and removes the Codex layer file.
    Both report per-lane failures, which the tab surfaces.

`.claude/settings.local.json` is added to the lane's git exclude, for both
native and router lanes: `agenthub lanes reset` runs `git clean -fd` without
`-x`, so an un-excluded settings file is deleted on reset — and untracked
meant the key was committable.

DB: `lanes.router_profile`, nullable, additive. Written only by
`setRouterProfile` beside the disk write, never through `PATCHABLE`.

client/src/lib/api.ts

@@ -1868,6 +1868,40 @@ export const api = {
       }),
   },
 
+  // ──────────────────────────────── AI Router API ─────────────────────────────
+  /** Named AI Router endpoints (9Router, OpenRouter, a self-hosted gateway) a
+   *  lane can be pointed at instead of the vendor's own API. Managed in the
+   *  **AI Router** tab of Settings; attached to a lane when the lane is created.
+   *
+   *  No response here ever carries an API key — a saved profile reports only
+   *  `hasKey`. */
+  aiRouters: {
+    /** GET /api/ai-routers - every profile, the built-in `native` one first. */
+    list: () => request<{ items: AiRouter[] }>("/ai-routers"),
+    /** POST /api/ai-routers - save a new profile. */
+    create: (body: AiRouterInput) =>
+      request<AiRouter>("/ai-routers", { method: "POST", body: JSON.stringify(body) }),
+    /**
+     * PATCH /api/ai-routers/:name - change a saved profile. Omitting `apiKey`
+     * keeps the stored one, which is what the edit form always does: it cannot
+     * display a key, so it has none to send back.
+     */
+    update: (name: string, body: Partial<AiRouterInput>) =>
+      request<AiRouter & { lanes: AiRouterLaneSync }>(`/ai-routers/${encodeURIComponent(name)}`, {
+        method: "PATCH",
+        body: JSON.stringify(body),
+      }),
+    /**
+     * DELETE /api/ai-routers/:name - also resets every lane using it back to
+     * native, on disk as well as in the DB.
+     */
+    remove: (name: string) =>
+      request<{ removed: string; lanes: AiRouterLaneSync }>(
+        `/ai-routers/${encodeURIComponent(name)}`,
+        { method: "DELETE" }
+      ),
+  },
+
   // ────────────────────────────────── Run API ─────────────────────────────────
   /** Spawn/manage headless or conversational `claude` CLI child processes
    *  launched from the dashboard's Run page, and stream their output. */
@@ -2434,6 +2468,16 @@ export const api = {
         method: "POST",
         body: "{}",
       }),
+    /**
+     * POST /lanes/:id/router/apply - point this lane at an AI Router profile,
+     * or back at `native`. Writes the lane's own config on disk; only the
+     * profile NAME comes from here.
+     */
+    routerApply: (id: number, profile: string) =>
+      request<{ tool: string; file: string | null; profile: string }>(`/lanes/${id}/router/apply`, {
+        method: "POST",
+        body: JSON.stringify({ profile }),
+      }),
     mcpSync: (id: number) =>
       request<{ servers: string[]; profilesSeeded: string[] }>(`/lanes/${id}/mcp/sync`, {
         method: "POST",
@@ -2609,6 +2653,53 @@ export interface CcProfile extends CcAccountIdentity {
  *  user + project scope in one response. */
 export type CcScope = "user" | "project" | "all";
 
+/** The per-tier model names an AI Router profile carries. Each maps to one env
+ *  var Claude Code reads; a router that names its models once fills them all
+ *  from the profile's `model`. */
+export interface AiRouterModels {
+  opus: string;
+  sonnet: string;
+  haiku: string;
+  smallFast: string;
+  subagent: string;
+}
+
+/** One saved AI Router profile, as the API returns it — **never** with a key. */
+export interface AiRouter {
+  /** Identifier, derived from the label. Stable: a lane stores this. */
+  name: string;
+  label: string;
+  /** True only for the read-only `native` profile (the vendor's own API). */
+  builtin: boolean;
+  /** Empty string for `native`, an http(s) URL otherwise. */
+  baseUrl: string;
+  /** Whether a key is stored. The key itself never leaves the server. */
+  hasKey: boolean;
+  model: string;
+  models: AiRouterModels;
+  savedAt?: string;
+}
+
+/** How an edit or a delete landed on the lanes already using that profile.
+ *  Attaching copies a profile, so the store alone is not the whole truth: a
+ *  lane listed in `failed` still carries the OLD key and endpoint. */
+export interface AiRouterLaneSync {
+  updated: number;
+  /** One `"<id> (<title>): <code>"` line per lane that could not be rewritten. */
+  failed: string[];
+}
+
+/** Body accepted when creating or updating a profile. */
+export interface AiRouterInput {
+  label: string;
+  baseUrl: string;
+  /** Omit on update to keep the stored key. */
+  apiKey?: string;
+  model: string;
+  /** Any tier left out is filled from `model`. */
+  models?: Partial<AiRouterModels>;
+}
+
 /** One markdown-based config artifact (skill/agent/command/output-style),
  *  as summarized by the `ccConfig` list endpoints. The list endpoints return
  *  a lightweight summary (frontmatter + a preview) rather than full contents;