fix: configure P2 and P3 OpenRouter models without code edits

[Dahkenangnon]

Summary:

• Let P2 and P3 choose an OpenRouter model through project environment variables while preserving free defaults and a zero-price cap.
• Require explicit paid-routing opt-in; keep P2 Voyage embeddings fixed.
• Pin P3's MCP Hono peer to patched 4.13.7 so its dependency audit passes.

Verification:

• P2 pnpm check: 78 tests passed; pnpm audit --audit-level low: clean.
• P3 pnpm check: 52 tests passed; pnpm audit --audit-level low: clean.
• Docker Compose configuration validates for both projects.