feat(qwen): Alibaba Qwen built-in over Model Studio's OpenAI-compatible mode

Adds the `qwen` built-in provider and the `qwen://` DSN scheme, keyed by
QWEN_API_KEY and defaulting to Model Studio's international host. Like kimi
(ADR-0026) it is `provider/openai` pointed elsewhere — no new client.

Model Studio serves the same models over two protocols, so the real decision
was which wire format to speak. ADR-0027 records why it is the OpenAI one:
down the anthropic client `ReasoningEffort` is ignored by design, structured
output rides the first-party `output_config.format` mechanism the shim does
not implement, and cached-token accounting reads Anthropic-only usage fields.
Each of those fails silently rather than loudly, which is what makes the
choice worth writing down. The shim stays reachable ad hoc via an
`anthropic://` DSN.

The kimi and qwen DSN factories were byte-identical, so they now share one
`openaiCompatScheme` helper: the "credential comes from the DSN token, and
the missing-key hint names LLM_<NAME>" rules hold by construction instead of
by copy.

Tests are hermetic and break-checked (all six fail on a deliberate mutation),
including the reverse credential leak — a visible QWEN_API_KEY must not
authenticate the openai built-in — and reasoning_effort asserted on the wire
body, which is the ADR's load-bearing claim.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

builtin_kimi_test.go

@@ -16,16 +16,25 @@ import (
 const kimiResponse = `{"id":"c1","object":"chat.completion","choices":[` +
 	`{"index":0,"message":{"role":"assistant","content":"ok"},"finish_reason":"stop"}]}`
 
-// captureRT records the last request and returns a canned response without
-// touching the network, so these tests stay hermetic while still exercising
-// the real openai client the kimi built-in reuses (base URL + auth header).
+// captureRT records the last request (and the bytes of its body) and returns a
+// canned response without touching the network, so these tests stay hermetic
+// while still exercising the real openai client the kimi and qwen built-ins
+// reuse: base URL, auth header, and the JSON actually put on the wire.
 type captureRT struct {
-	req  *http.Request
-	body string
+	req     *http.Request
+	reqBody []byte
+	body    string
 }
 
 func (c *captureRT) RoundTrip(r *http.Request) (*http.Response, error) {
 	c.req = r
+	// Drain and close the request body: a RoundTripper owns it, and those
+	// bytes are what wire-shape assertions read.
+	c.reqBody = nil
+	if r.Body != nil {
+		c.reqBody, _ = io.ReadAll(r.Body)
+		_ = r.Body.Close()
+	}
 	return &http.Response{
 		StatusCode: http.StatusOK,
 		Body:       io.NopCloser(strings.NewReader(c.body)),