feat(openrouter): validate API key at save time

The stored key that caused the persistent 401s turned out to be only
9 characters long — an accepted-but-truncated paste. Prevent this class
of problem at the source:
- require a minimum key length in the zod schema
- verify new keys against OpenRouter's /api/v1/key endpoint on save,
  rejecting explicit 401/403 (network errors don't block saving)
- return zod validation messages as 400 instead of a generic 500
- surface the server's error message in the settings toast (desktop
  and mobile) instead of a generic failure text

client/src/pages/mobile/settings.tsx

@@ -157,10 +157,17 @@ export default function SettingsMobile() {
       });
       setOpenrouterApiKey("");
     },
-    onError: () => {
+    onError: (error: Error) => {
+      let description = "Impossible de sauvegarder la configuration OpenRouter";
+      const body = error.message.match(/^\d+:\s*(.+)$/)?.[1];
+      if (body) {
+        try {
+          description = JSON.parse(body).error || description;
+        } catch { /* garder le message générique */ }
+      }
       toast({
         title: "Erreur",
-        description: "Impossible de sauvegarder la configuration OpenRouter",
+        description,
         variant: "destructive",
       });
     },

client/src/pages/settings.tsx

@@ -161,10 +161,17 @@ export default function Settings() {
       });
       setOpenrouterApiKey(""); // Clear the API key after saving
     },
-    onError: () => {
+    onError: (error: Error) => {
+      let description = "Impossible de sauvegarder la configuration OpenRouter";
+      const body = error.message.match(/^\d+:\s*(.+)$/)?.[1];
+      if (body) {
+        try {
+          description = JSON.parse(body).error || description;
+        } catch { /* garder le message générique */ }
+      }
       toast({
         title: "Erreur",
-        description: "Impossible de sauvegarder la configuration OpenRouter",
+        description,
         variant: "destructive",
       });
     },