feat(providers): pluggable agent providers + Grok (xAI) backend

Add a roboco/llm/providers/ seam — an AgentProvider lifecycle ABC and a
ProviderRegistry keyed by ModelProvider — so the orchestrator can drive
agent backends other than Claude Code.

The first non-Claude backend is GrokProvider for xAI's grok-build-0.1.
xAI is OpenAI-compatible only (no Anthropic-Messages endpoint), so a Grok
agent runs an OpenAI-protocol runtime pointed at https://api.x.ai/v1
rather than the ANTHROPIC_BASE_URL injection the other providers use. It
reuses the orchestrator's existing mount/auth assembly, so it inherits the
same MCP gateway + tool-manifest wiring as every other agent by
construction, and passes its prompt via env (never an argv positional).

The change is purely additive: only GROK routes through the registry;
Anthropic / Ollama Cloud / self-hosted spawns run the existing
_spawn_container path unchanged.

Includes:
- ModelProvider.GROK (migration 038) + a seeded Grok provider row
  (migration 039) + a grok-build-0.1 catalog entry
- GET/PUT /api/providers/grok-key to store the xAI key (Fernet-encrypted,
  reusing the existing provider-key machinery)
- ClaudeCodeProvider reference adapter over the current spawn
- unit tests for the registry, GrokProvider (gateway wiring, no
  ANTHROPIC_* leak, prompt-injection safety, failure paths) and routing

The dedicated roboco-agent-grok image and the exact OpenAI-protocol CLI
invocation are the remaining piece to finalise with xAI.

tests/unit/runtime/test_provider_routing.py

@@ -0,0 +1,41 @@
+"""The orchestrator routes only dedicated-backend providers through the registry.
+
+GROK gets the GrokProvider; Anthropic / Ollama Cloud / self-hosted (and any
+unknown value) return None so ``_spawn_container`` runs its built-in Claude Code
+path unchanged. This keeps the GROK addition purely additive.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import patch
+
+from roboco.llm.providers import GrokProvider
+from roboco.runtime.orchestrator import AgentOrchestrator
+
+
+def _make_orch() -> AgentOrchestrator:
+    with patch.object(AgentOrchestrator, "__init__", return_value=None):
+        orch = AgentOrchestrator.__new__(AgentOrchestrator)
+    orch._provider_registry = None
+    return orch
+
+
+def test_provider_for_grok_returns_grok_provider() -> None:
+    assert isinstance(_make_orch()._provider_for("grok"), GrokProvider)
+
+
+def test_provider_for_anthropic_returns_none() -> None:
+    assert _make_orch()._provider_for("anthropic") is None
+
+
+def test_provider_for_ollama_cloud_returns_none() -> None:
+    assert _make_orch()._provider_for("ollama_cloud") is None
+
+
+def test_provider_for_unknown_value_returns_none() -> None:
+    assert _make_orch()._provider_for("bogus") is None
+
+
+def test_provider_registry_built_once() -> None:
+    orch = _make_orch()
+    assert orch._ensure_provider_registry() is orch._ensure_provider_registry()