feat(service): transparent pass-through proxy for unhandled provider endpoints

[carlosatta]

Summary

Closes #100

• Any path not explicitly handled by Routerly is now forwarded to the project's upstream provider with only the API key swapped — makes Routerly a true drop-in replacement today and for any future provider endpoints without requiring updates
• Upstream is selected by matching the request body's model field against project models, falling back to the first configured model; Anthropic/anthropic-web use x-api-key, all other providers use Authorization: Bearer
• Reserved namespaces (/, /health, /api/*, /dashboard*) are guarded inside the handler and always return 404 — never proxied

Changes

• plugins/auth.ts — extract resolveProjectByToken() as a shared exported helper (no behaviour change to existing auth hook)
• routes/passthrough.ts — new: pure helpers pickUpstreamModel, buildUpstreamUrl, buildUpstreamHeaders + passthroughHandler registered as fastify.setNotFoundHandler
• server.ts — add * content-type parser (non-JSON bodies captured as Buffer for verbatim forwarding) + wire setNotFoundHandler
• server.telemetry.test.ts — add missing mock stubs (addContentTypeParser, passthroughHandler)

Test plan

• 22 new tests in passthrough.test.ts covering all pure helpers and handler scenarios (model selection, URL building, header injection, proxy flow, auth failures, 502 cases, reserved-path guard)
• npm test --workspace=packages/service → 1027/1027 passed
• npm run typecheck --workspace=packages/service → clean

Manual E2E:

# start server
npm run dev

# pass-through: embeddings (not handled by Routerly)
curl -s http://localhost:3000/v1/embeddings \
  -H "Authorization: Bearer <project-token>" \
  -H "content-type: application/json" \
  -d '{"model":"text-embedding-3-small","input":"hello"}'

# reserved path — must return 404, not proxied
curl -i http://localhost:3000/api/does-not-exist \
  -H "Authorization: Bearer <project-token>"

# existing route — must still go through routing engine unchanged
curl -s http://localhost:3000/v1/chat/completions \
  -H "Authorization: Bearer <project-token>" \
  -H "content-type: application/json" \
  -d '{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}'

🤖 Generated with Claude Code