feat(openrouter): forward session_id and add app category header

[Lee-Si-Yoon]

Summary

OpenRouter dashboard provides per-session grouping via a non-standard session_id field in the request body. Goose was sending user (OpenAI standard end-user field) and agent-session-id header (goose telemetry), but neither triggers OpenRouter session grouping or sticky routing.

This PR:

• Injects session_id into the request JSON body top-level alongside the existing user field
• Adds X-OpenRouter-Categories: cli-agent,productivity header for marketplace category attribution
• Removes stale comment that described only the user field

Background

OpenRouter's session_id is a proprietary extension field (not part of OpenAI Chat Completions spec). When present, OpenRouter groups requests by session in the dashboard and uses it for sticky routing to maximize prompt cache hits. Without it, only per-request view is available.

HTTP-Referer and X-Title headers were already implemented. X-OpenRouter-Categories was missing.

Changes

crates/goose/src/providers/openrouter.rs:

1. from_env(): add .with_header("X-OpenRouter-Categories", "cli-agent,productivity")
2. stream(): add obj.insert("session_id", ...) next to existing user field injection

Verification

• cargo build -p goose ✅
• cargo test -p goose --lib -- openrouter ✅ (20 passed, 0 failed)
• cargo clippy -p goose --lib -- -D warnings ✅
• cargo fmt ✅

[Lee-Si-Yoon]

@jamadeo

Would appreciate a review when you get a chance. This PR adds OpenRouter session_id body field forwarding and the missing X-OpenRouter-Categories app attribution header.

[michaelneale]

🤖 Flagging a collision before either of these lands, since this PR has been open 19 days without review.

#11334 overlaps this PR and is already approved. Both modify the same if !session_id.is_empty() block in crates/goose/src/providers/openrouter.rs. I verified they conflict rather than assuming it — git merge-tree on their merge base produces two conflict regions in that block:

• This PR keeps user and adds session_id alongside it
• fix(openrouter): send session_id in request body for provider sticky routing #11334 replaces user with session_id (title: "drop user field, keep only session_id for sticky routing")

So there's a real semantic disagreement underneath the textual conflict: whether user should still be sent. That's a maintainer call, not something a merge resolution should decide silently.

Two things in this PR are not in #11334 and would be lost if #11334 simply lands first:

1. The X-OpenRouter-Categories: cli-agent,productivity header
2. Keeping the user field for attribution/rate-limiting

Conversely, #11334 adds a wiremock test asserting the body field, which this PR has no test for.

Worth someone deciding explicitly: either close this as superseded, or rebase it onto #11334 to keep just the category header. Not asking for a change — just making sure a 19-day-old contribution doesn't get quietly overwritten.

I have no stake in which way this goes; I'm triaging unreviewed PRs and this was the clearest duplicate.