feat: add 'openai' as auxiliary provider option

Users can now set provider: "openai" for auxiliary tasks (vision, web
extract, compression) to use OpenAI's API directly with their
OPENAI_API_KEY. This hits api.openai.com/v1 with gpt-4o-mini as the
default model — supports vision since GPT-4o handles image input.

Provider options are now: auto, openrouter, nous, openai, main.

Changes:
- agent/auxiliary_client.py: added _try_openai(), "openai" case in
  _resolve_forced_provider(), updated auxiliary_max_tokens_param()
  to use max_completion_tokens for OpenAI
- Updated docs: cli-config.yaml.example, AGENTS.md, and user-facing
  configuration.md with Common Setups section showing OpenAI,
  OpenRouter, and local model examples
- 3 new tests for OpenAI provider resolution

Tests: 2459 passed (was 2429).

cli-config.yaml.example

@@ -241,6 +241,9 @@ compression:
 #   "auto"       - Best available: OpenRouter → Nous Portal → main endpoint (default)
 #   "openrouter" - Force OpenRouter (requires OPENROUTER_API_KEY)
 #   "nous"       - Force Nous Portal (requires: hermes login)
+#   "openai"     - Force OpenAI direct API (requires OPENAI_API_KEY).
+#                  Uses api.openai.com/v1 with models like gpt-4o, gpt-4o-mini.
+#                  Great for vision since GPT-4o supports image input.
 #   "main"       - Use the same provider & credentials as your main chat model.
 #                  Skips OpenRouter/Nous and uses your custom endpoint
 #                  (OPENAI_BASE_URL), Codex OAuth, or API-key provider directly.