feat: add 'openai' as auxiliary provider option

Users can now set provider: "openai" for auxiliary tasks (vision, web
extract, compression) to use OpenAI's API directly with their
OPENAI_API_KEY. This hits api.openai.com/v1 with gpt-4o-mini as the
default model — supports vision since GPT-4o handles image input.

Provider options are now: auto, openrouter, nous, openai, main.

Changes:
- agent/auxiliary_client.py: added _try_openai(), "openai" case in
  _resolve_forced_provider(), updated auxiliary_max_tokens_param()
  to use max_completion_tokens for OpenAI
- Updated docs: cli-config.yaml.example, AGENTS.md, and user-facing
  configuration.md with Common Setups section showing OpenAI,
  OpenRouter, and local model examples
- 3 new tests for OpenAI provider resolution

Tests: 2459 passed (was 2429).

tests/agent/test_auxiliary_client.py

@@ -218,6 +218,15 @@ class TestVisionClientFallback:
         assert client is None
         assert model is None
 
+    def test_vision_forced_openai(self, monkeypatch):
+        """When forced to 'openai', vision uses OpenAI direct API."""
+        monkeypatch.setenv("AUXILIARY_VISION_PROVIDER", "openai")
+        monkeypatch.setenv("OPENAI_API_KEY", "sk-test")
+        with patch("agent.auxiliary_client.OpenAI") as mock_openai:
+            client, model = get_vision_auxiliary_client()
+        assert client is not None
+        assert model == "gpt-4o-mini"
+
 
 class TestGetAuxiliaryProvider:
     """Tests for _get_auxiliary_provider env var resolution."""
@@ -313,6 +322,22 @@ class TestResolveForcedProvider:
         assert isinstance(client, CodexAuxiliaryClient)
         assert model == "gpt-5.3-codex"
 
+    def test_forced_openai_with_key(self, monkeypatch):
+        monkeypatch.setenv("OPENAI_API_KEY", "sk-test-key")
+        with patch("agent.auxiliary_client.OpenAI") as mock_openai:
+            client, model = _resolve_forced_provider("openai")
+        assert model == "gpt-4o-mini"
+        assert client is not None
+        call_kwargs = mock_openai.call_args
+        assert call_kwargs.kwargs["base_url"] == "https://api.openai.com/v1"
+        assert call_kwargs.kwargs["api_key"] == "sk-test-key"
+
+    def test_forced_openai_no_key(self, monkeypatch):
+        monkeypatch.delenv("OPENAI_API_KEY", raising=False)
+        client, model = _resolve_forced_provider("openai")
+        assert client is None
+        assert model is None
+
     def test_forced_unknown_returns_none(self, monkeypatch):
         with patch("agent.auxiliary_client._read_nous_auth", return_value=None), \
              patch("agent.auxiliary_client._read_codex_access_token", return_value=None):