fix(ai-gateway): enforce exclusive provider filters

[chrarnoldus]

Summary

• enforce provider.only and provider.ignore for Kilo-exclusive model inference providers
• apply request-level data collection restrictions after model routing is resolved
• return a provider-not-allowed response when filtering excludes the exclusive provider

Validation

• pnpm exec oxfmt --list-different apps/web/src/app/api/openrouter/[...path]/route.ts apps/web/src/lib/ai-gateway/llm-proxy-helpers.ts
• pnpm --filter web lint
• pnpm --filter web typecheck
• git diff --cached --check

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

• apps/web/src/app/api/openrouter/[...path]/route.ts

Previous Review Summary (commit 1720cbe)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 1720cbe)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/app/api/openrouter/[...path]/route.ts	812	Organization and request data-collection opt-outs can be dropped
apps/web/src/app/api/openrouter/[...path]/route.ts	819	Caller provider filters can be overwritten before validation

Files Reviewed (2 files)

• apps/web/src/app/api/openrouter/[...path]/route.ts - 2 issues
• apps/web/src/lib/ai-gateway/llm-proxy-helpers.ts - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by gpt-5.6-sol · Input: 42K · Output: 6.3K · Cached: 162.9K}

_{Review guidance: REVIEW.md from base branch main}