fix(ai): make OpenCode the default provider (was falling through to Gemini)

The provider chain tried OpenRouter before OpenCode, and aiChat forced a paid
OpenRouter model (openai/gpt-4o-mini) whenever OPENROUTER_API_KEY was set in env
— so the finding-report button cascaded OpenRouter -> Gemini and failed on
Gemini's free-tier 429 even when an OpenCode key was configured.

- brain.go callAI + ChatWithAI: reorder to OpenCode -> OpenRouter -> Z.ai -> Gemini.
- ui_api.go aiChat: only use OpenRouter directly when a key is pasted in the UI
  (X-OpenRouter-Key header). An OpenRouter env key no longer overrides the
  OpenCode default — it's just a fallback in the chain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: h0tak88r

internal/api/ui_api.go

@@ -2171,20 +2171,19 @@ func openRouterChat(c *gin.Context, systemPrompt, userPrompt string) (string, er
 	return result.Choices[0].Message.Content, nil
 }
 
-// aiChat routes a system+user prompt to the first available AI provider.
-// Preference: an OpenRouter key (UI X-OpenRouter-Key header or OPENROUTER_API_KEY)
-// is used first; otherwise (or if OpenRouter errors) it falls back to the shared
-// brain provider chain (OpenCode → Z.ai → Gemini). This keeps the dashboard AI
-// helpers working when the user only configured the free OpenCode provider.
+// aiChat routes a system+user prompt to the shared brain provider chain, which
+// prefers OpenCode (the free default) → OpenRouter → Z.ai → Gemini based on which
+// keys are configured. The only exception is an OpenRouter key pasted directly in
+// the UI (X-OpenRouter-Key header): when present, that explicit choice is honored
+// first. An OpenRouter key set merely via env does NOT override the OpenCode
+// default — it's just a fallback in the chain.
 func aiChat(c *gin.Context, systemPrompt, userPrompt string) (string, error) {
-	hasOR := strings.TrimSpace(c.GetHeader("X-OpenRouter-Key")) != "" ||
-		strings.TrimSpace(os.Getenv("OPENROUTER_API_KEY")) != ""
-	if hasOR {
+	if strings.TrimSpace(c.GetHeader("X-OpenRouter-Key")) != "" {
 		out, err := openRouterChat(c, systemPrompt, userPrompt)
 		if err == nil {
 			return out, nil
 		}
-		log.Printf("[API] OpenRouter chat failed, falling back to OpenCode/Gemini: %v", err)
+		log.Printf("[API] OpenRouter (UI key) failed, falling back to provider chain: %v", err)
 	}
 	return brain.ChatWithAI(nil, userPrompt, systemPrompt)
 }

internal/brain/brain.go

@@ -501,25 +501,25 @@ Command Outputs:
 }
 
 // callAI routes to whichever AI provider has a key configured.
-// Priority: OpenRouter (premium models) → OpenCode (free) → Z.ai → Gemini.
+// Priority: OpenCode (free default) → OpenRouter → Z.ai → Gemini.
 func callAI(prompt, orKey, geminiKey string) (string, error) {
 	ocKey := strings.TrimSpace(os.Getenv("OPENCODE_API_KEY"))
 	zaiKey := strings.TrimSpace(os.Getenv("ZHIPU_API_KEY"))
 
-	if orKey != "" {
-		res, err := callOpenRouter(prompt, orKey)
+	if ocKey != "" {
+		res, err := callOpenCode(prompt, ocKey)
 		if err == nil {
 			return res, nil
 		}
-		logger.GetLogger().Infof("[BRAIN] OpenRouter failed, falling back to other providers: %v", err)
+		logger.GetLogger().Infof("[BRAIN] OpenCode failed, falling back to other providers: %v", err)
 	}
 
-	if ocKey != "" {
-		res, err := callOpenCode(prompt, ocKey)
+	if orKey != "" {
+		res, err := callOpenRouter(prompt, orKey)
 		if err == nil {
 			return res, nil
 		}
-		logger.GetLogger().Infof("[BRAIN] OpenCode failed, falling back to other providers: %v", err)
+		logger.GetLogger().Infof("[BRAIN] OpenRouter failed, falling back to other providers: %v", err)
 	}
 
 	if zaiKey != "" {
@@ -683,20 +683,20 @@ func ChatWithAI(history []Message, userMessage string, systemPrompt string) (str
 	messages = append(messages, history...)
 	messages = append(messages, Message{Role: "user", Content: userMessage})
 
-	if openRouterKey != "" {
-		res, err := callOpenRouterMulti(messages, openRouterKey)
+	if openCodeKey != "" {
+		res, err := callOpenCodeMulti(messages, openCodeKey)
 		if err == nil {
 			return res, nil
 		}
-		logger.GetLogger().Infof("[BRAIN] OpenRouter failed, falling back to other providers: %v", err)
+		logger.GetLogger().Infof("[BRAIN] OpenCode failed, falling back to other providers: %v", err)
 	}
 
-	if openCodeKey != "" {
-		res, err := callOpenCodeMulti(messages, openCodeKey)
+	if openRouterKey != "" {
+		res, err := callOpenRouterMulti(messages, openRouterKey)
 		if err == nil {
 			return res, nil
 		}
-		logger.GetLogger().Infof("[BRAIN] OpenCode failed, falling back to other providers: %v", err)
+		logger.GetLogger().Infof("[BRAIN] OpenRouter failed, falling back to other providers: %v", err)
 	}
 
 	zaiKey := strings.TrimSpace(os.Getenv("ZHIPU_API_KEY"))