feat(providers): add ClinePass provider (API key)

[adentdk]

Summary

Add end-to-end support for ClinePass, Cline's flat $9.99/month subscription that proxies through Cline's OpenAI-compatible Chat Completions endpoint. Authentication is by API key from Settings > API Keys in app.cline.bot (per the docs) — the OAuth flow with client_type=extension is the IDE extension flow and is unrelated.

Brings the ClinePass model catalog (cline-pass/..., 10 models) into the existing /v1/models flow with proper thinking handling.

Closes #2252 (no separate OAuth flow needed — API key was the intended path)

What's in

• open-sse/providers/registry/clinepass.js — provider registry entry; category: "apikey"
• open-sse/providers/capabilities.js — capability hints for deepseek-v4-pro / deepseek-v4-flash
• open-sse/services/clinepassModels.js — /v1/models live resolver (works with API key)
• open-sse/utils/clinepassEnvelope.js — unwraps ClinePass's {success,data} response envelope and the error path
• open-sse/executors/default.js — max_tokens floor (4096) for reasoning-enabled models to avoid empty-content length finishes
• open-sse/translator/concerns/thinkingUnified.js — map internal max → xhigh, drop unknown levels (Vercel/OpenAI only accept {none,minimal,low,medium,high,xhigh})
• open-sse/handlers/chatCore.js + nonStreamingHandler.js — envelope unwrap + one retry on transient empty response content
• open-sse/utils/error.js — error path uses envelope unwrap
• src/lib/oauth/providers.js — clinepass registered as flowType: "apikey"
• src/app/api/v1/models/route.js — live resolver wiring

Why an API key, not OAuth

Issue #2252 hit a 401 on client_type=extension OAuth — that flow is for the Cline IDE extension and produces a token the API rejects. ClinePass itself authenticates with a regular API key from app.cline.bot/settings/api-keys.

How to try it

1. Subscribe to ClinePass at https://app.cline.bot.
2. Create an API key at https://app.cline.bot/settings/api-keys.
3. In 9Router → Providers → ClinePass → paste the API key.
4. Add a model with ID clinepass/deepseek-v4-flash (or -pro, or any of the 10 listed in the registry).
5. Test — should succeed without the 401.

Tested locally

• /v1/models returns the 10 ClinePass models.
• deepseek-v4-pro reasoning responses return non-empty content within budget.

Branch: feat-clinepass-provider on https://github.com/adentdk/9router

[adentdk]

Update: shortened model aliases (8fe0652)

The model alias was unnecessarily long: clinepass/cline-pass/deepseek-v4-pro — because the upstream API's cline-pass/ prefix was concatenated with the clinepass/ provider alias without stripping.

Changes:

• Registry model IDs no longer include the prefix: deepseek-v4-pro (was cline-pass/deepseek-v4-pro)
• upstreamModelId added so the upstream Cline API still receives the full prefixed ID
• Live resolver (clinepassModels.js) now strips the prefix from API-returned models

Result: "model": "clinepass/deepseek-v4-pro" — clean, two-segment alias.

[ohahe52-dot]

Thanks for taking the time to review my issue and for submitting a pull request to address it.

I understand that it uses an API key for authentication and usage. Initially, I tried using the OpenAI-compatible API, but it returned a 404 error. It seems that Cline is blocking it.

Hopefully your pull request will be merged into 9router soon, so I can use Cline Pass more smoothly without these authentication issues.

[decolua]

Thanks @adentdk for the contribution! Reviewed and accepted — applying it to master. 🙏