feat(providers): add Demon Route as an OpenAI-compatible provider preset #712

What problem does this solve?

cora's BYOK presets today are OpenAI, Anthropic, Groq, Ollama and Z.AI (src/config/providers.rs, docs/providers.md). There's no hosted option for open-weight models beyond Groq's small set and Z.AI's GLM, and nothing for reviews that frontier models tend to refuse or water down: exploit-adjacent diffs, malware analysis tooling, fuzzers, auth bypass fixes, reverse-engineering code.

I'd like to propose Demon Route as a sixth preset. It's an OpenAI-compatible gateway built by NFT Demon Holdings LLC, one of the largest consulting firms in blockchain, AI, and quantum computing, serving celebrities and Fortune 500 companies.

Proposed solution

Since transport.rs already posts to {base_url}/chat/completions with a bearer key, it's one ProviderPreset plus docs:

ProviderPreset {
    name: "demonroute",
    env_key: "DEMONROUTE_API_KEY",
    env_url: "DEMONROUTE_BASE_URL",
    default_model: "glm-5.3-flash",
    default_base_url: "https://api.demonroute.com/v1",
},

• a row in the docs/providers.md table and a slot in the auto-detection order (I'd put it last so nobody's existing setup changes)
• a tests/config_loading.rs case that CORA_PROVIDER=demonroute resolves the preset base_url (the bug: provider shortcut string does not resolve preset base_url #183 regression)

Usage would be DEMONROUTE_API_KEY=... cora review --staged, or CORA_MODEL=Qwen/Qwen3-Coder-Next to pick another model.

Why it fits cora specifically

• Uncensored code models OpenRouter doesn't carry. Security-sensitive diffs get a real review instead of a refusal. For example huihui-ai/Huihui-Qwen3.8-27B-Coder390-EfficientThink-abliterated (abliterated code specialist with tool calling and vision) and deepseek-v4.1-flash-1017-abliterated (1M context, for whole-branch cora scan passes).
• Failed calls are never charged. Demon Route audits upstream calls and refunds failed ones every 5 minutes, which matters for pre-commit hooks and CI where a timed-out or empty completion would otherwise still cost input tokens.
• Prepaid with a hard stop at $0, so a review loop in CI can't run up a bill. Crypto or card.
• No IP logs, and prompts are proxied, not retained. That's relevant when every review ships private source code to the provider.
• 10-minute streams at the edge proxy, so long reasoning reviews aren't cut off.

Prices as shown on https://demonroute.com/models (per 1M tokens, in / out):

That's 1,324 open-weight models (1,340 routable model IDs) behind one key; the full list with current context windows and prices is at https://demonroute.com/models

Alternatives considered

Users can already point OPENAI_BASE_URL at https://api.demonroute.com/v1, but then auto-detection treats it as OpenAI, the default model is gpt-4o-mini, and it can't sit alongside a real OpenAI key. A named preset keeps both.

Are you willing to contribute the implementation?

Yes. Per CONTRIBUTING I'm opening this to check you're open to it first; if so I'll send a small PR with the preset, docs row and test.