feat: cfGateway config for per-provider AI Gateway passthrough

[stackbilt-admin]

Closes #97

Implemented via constellation-loop.

What

• Adds cfGateway?: { accountId, gatewayId } to 5 HTTP provider configs (OpenAI, Anthropic, Cerebras, Groq, NVIDIA)
• Derives baseUrl automatically per-provider when set (suffixes: openai/v1, anthropic, cerebras/v1, groq/openai/v1, nvidia-nim/v1)
• Injects cf-aig-cache-ttl/cf-aig-cache-key/cf-aig-skip-cache headers from request.gatewayMetadata when the gateway is active (each only if its field is defined)
• Explicit baseUrl override disables gateway-active mode entirely (no header injection)
• Throws CfGatewayInvalidConfigError (CF_GATEWAY_INVALID_CONFIG) synchronously in constructor on empty accountId/gatewayId
• New GatewayMetadata.skipCache field; exported CfGatewayConfig type
• README composable-pattern section + CHANGELOG entry

Tests

• URL derivation for all 5 providers
• Constructor validation (empty accountId/gatewayId)
• Header injection / omission / skipCache true|false serialization
• baseUrl override regression
• Full suite: 487 passing

Note for reviewer

Several edited files (errors.ts, index.ts, types.ts, base.ts) had pre-existing mixed CRLF/LF line endings; the editor normalized them to the file's dominant CRLF, which inflates the line-change count. The semantic diff is small — verify with git diff -w or by stripping CR.

[stackbilt-admin]

Review: cfGateway per-provider AI Gateway passthrough — APPROVED

Reviewed against the locked contract; all constraints hold. Diff is CRLF-inflated (749/+320) but the semantic change is ~120 lines, fully additive.

Verified

1. URL derivation — base https://gateway.ai.cloudflare.com/v1/{accountId}/{gatewayId}/ correct; all 5 suffixes match: openai→openai/v1, anthropic→anthropic, cerebras→cerebras/v1, groq→groq/openai/v1, nvidia→nvidia-nim/v1 (base.ts:69, per-provider constructors). Anthropic correctly versionless, with /v1/messages appended at the endpoint.
2. Precedence — explicit baseUrl returns early with cfGatewayActive=false (base.ts:63); since the constructor stores only the explicit config.baseUrl, the derived URL never leaks into getAIGatewayHeaders (which reads this.config.baseUrl), so the two header paths don't double-fire. Tested (cf-gateway.test.ts:127).
3. Header wire types — cf-aig-skip-cache serialized via String(boolean) → "true"/"false" (base.ts:408); cf-aig-cache-ttl numeric string via String(number) (base.ts:402). Each header gated on typeof of its source field, so undefined fields are omitted. Tested.
4. Constructor throw — empty accountId/gatewayId throws CfGatewayInvalidConfigError synchronously in resolveCfGateway before URL derivation (base.ts:54-61). Tested for both fields and both throw-styles.
5. Error shape — code: 'CF_GATEWAY_INVALID_CONFIG', field: 'accountId'|'gatewayId', provider all present (errors.ts:100). Tested.
6. Workers AI isolation — src/providers/cloudflare.ts untouched (confirmed via git diff); CloudflareConfig keeps its ai binding + gateway options, no cfGateway.
7. skipCache field — GatewayMetadata.skipCache?: boolean (types.ts:31), serialized to string on the wire.
8. Test coverage — 13 new tests cover URL derivation (all 5), constructor validation (both fields), header injection/omission, skipCache true|false, baseUrl override, and gateway-inactive. Full suite 487 passing locally.
9. Public API — CfGatewayConfig and CfGatewayInvalidConfigError exported from index.ts; both exercised in tests.
10. README + CHANGELOG — both updated per OSS policy; README wire-value table matches implementation.

Clean, contract-faithful, additive-only. LGTM (non-blocking comment review).