fix: fail fast when explicit provider has no API key instead of silent OpenRouter fallback

[StefanIsMe]

Problem

When provider: minimax (or any non-OpenRouter provider) is set in config.yaml but the corresponding API key environment variable (MINIMAX_API_KEY) is not set, Hermes silently falls back to OpenRouter.

This causes a confusing 404 error because:

1. OpenRouter receives the request with the MiniMax model name
2. OpenRouter tries to route to MiniMax's API but gets a 404 (wrong endpoint or no credentials for that route)
3. The user sees a 404 with no explanation of why Hermes is talking to OpenRouter at all

Root Cause

Two code paths silently fell back to OpenRouter when a provider had no credentials:

1. run_agent.py AIAgent.init (lines 734-744):

else:
    # Final fallback: try raw OpenRouter key
    client_kwargs = {api_key: ..., base_url: OPENROUTER_BASE_URL}

2. auxiliary_client.py call_llm (lines 1429-1435):

if client is None:
    if resolved_provider != "openrouter" and not resolved_base_url:
        logger.warning("Provider %s unavailable, falling back to openrouter")
        client, final_model = _get_cached_client("openrouter", ...)

Fix

In both locations, before falling back to OpenRouter, check if the user explicitly configured a non-OpenRouter provider. If so, raise RuntimeError with a clear message:

For auto/custom/openrouter providers, the OpenRouter fallback behavior is preserved — appropriate for auto-detection scenarios where the user hasn't pinned a specific provider.

Testing

Logic verified:

• 'minimax' with no key → raises error telling user to set MINIMAX_API_KEY
• 'anthropic' with no key → raises error telling user to set ANTHROPIC_API_KEY
• 'auto'/'openrouter'/'custom' → falls through to OpenRouter (unchanged)

[teknium1]

Merged via PR #2445. Your fix was applied manually onto current main with two improvements:

1. Fixed a pconfig.api_key_env_vars NameError in the auxiliary_client.py path (pconfig doesn't exist in call_llm's scope)
2. Extended the guard to call_llm_streaming which had the same silent OpenRouter fallback

Your authorship is preserved on the commit. Thanks @StefanIsMe!