fix(schema): add openrouter to provider check constraint, unmask key input

The ai_extraction_config table has a CHECK constraint that only allowed
openai, anthropic, ollama. Add openrouter via migration 061.

Also remove -s flag from API key read so input is visible — easier to
verify the key was pasted correctly.

Author: aaronsb

operator/lib/guided-init.sh

@@ -371,7 +371,7 @@ echo ""
 
 API_KEY_STORED=false
 while [ "$API_KEY_STORED" = false ]; do
-    read -sp "${AI_KEY_PROMPT}: " AI_KEY
+    read -p "${AI_KEY_PROMPT}: " AI_KEY
     echo ""
 
     if [ -z "$AI_KEY" ]; then

schema/migrations/061_add_openrouter_provider.sql

@@ -0,0 +1,14 @@
+-- Migration 061: Add openrouter to ai_extraction_config provider check constraint (ADR-800)
+
+ALTER TABLE kg_api.ai_extraction_config
+    DROP CONSTRAINT IF EXISTS ai_extraction_config_provider_check;
+
+ALTER TABLE kg_api.ai_extraction_config
+    ADD CONSTRAINT ai_extraction_config_provider_check
+    CHECK (provider IN ('openai', 'anthropic', 'ollama', 'openrouter'));
+
+-- ===========================================================================
+
+INSERT INTO public.schema_migrations (version, name)
+VALUES (61, 'add_openrouter_provider')
+ON CONFLICT (version) DO NOTHING;