Point the extension's AI calls at the backend proxy

[PAMulligan]

Description

Replace the extension's direct provider calls with calls to the deployed backend proxy. Today app/src/lib/openai.ts calls OpenAI from the browser (dangerouslyAllowBrowser: true) with a dev-only proxy at /api/openai. The production proxy now exists and is live: POST /ai/generate (staging https://optia-backend-staging.paul-130.workers.dev, production https://api.optia-api.com) — entitlement-gated, metered, served by Anthropic (claude-haiku-4-5), response shape { checkId, recommendation, model, quota }.

Split out of the #7 audit: #7 covered the server side and is closed; #8/#9/#12 imply this switch but none owns it. This issue owns it.

Why

The free tier only works if the provider key stays server-side, and metering is only enforceable at the proxy — a client still calling the provider directly bypasses both. This is the single networking change the entitlement layer (#8), gating (#9), and paywall (#10) all sit on top of.

Acceptance Criteria

• Hosted-mode AI requests go to POST {API_BASE}/ai/generate with { checkId, keyword, context, installId? } — no direct provider call and no dangerouslyAllowBrowser in hosted mode
• Pro installs send the cached entitlement in the X-Optia-Entitlement header; free installs send installId only
• API_BASE configurable per build target (staging/production), never localhost in release builds
• quota from the response feeds the entitlement layer's aiQuotaRemaining (Add client-side entitlement layer and feature-flag system #8)
• Error mapping: 429 QUOTA_EXCEEDED → over-quota upgrade prompt (Build paywall and upgrade UI in the side panel #10); 429 RATE_LIMITED → retry-later message; 401 → entitlement refresh, one retry; 502 UPSTREAM_ERROR → friendly provider-error message (no dead ends)
• BYO-key routing decided and documented: direct-to-provider (2026-07-19) — the backend's Authorization passthrough is removed (PMDevSolutions/optia-backend#17), so hosted-mode requests never send an Authorization header; a Pro user's own Anthropic key goes straight from the extension to the provider (Retain bring-your-own Anthropic key as a Pro option #12). Product is Anthropic-only — no OpenAI
• Tests cover free, Pro, over-quota, and each error path against a mocked backend
• CI passes

Resources

• app/src/lib/openai.ts (current direct client), app/src/lib/storage.ts
• Backend contract: src/routes/ai.ts and src/types/index.ts (aiGenerateSchema) in PMDevSolutions/optia-backend
• Depends on: entitlement layer (Add client-side entitlement layer and feature-flag system #8); relates to gating (Define and implement free vs Pro feature gating #9), paywall (Build paywall and upgrade UI in the side panel #10), BYO-key (Retain bring-your-own Anthropic key as a Pro option #12); feeds QA (QA and bug-hardening pass for a stable v1.0.0 #16)