feat(openrouter): validate API key at save time

The stored key that caused the persistent 401s turned out to be only
9 characters long — an accepted-but-truncated paste. Prevent this class
of problem at the source:
- require a minimum key length in the zod schema
- verify new keys against OpenRouter's /api/v1/key endpoint on save,
  rejecting explicit 401/403 (network errors don't block saving)
- return zod validation messages as 400 instead of a generic 500
- surface the server's error message in the settings toast (desktop
  and mobile) instead of a generic failure text

server/routes.ts

@@ -1844,6 +1844,10 @@ export async function registerRoutes(app: Express): Promise<Server> {
           return res.status(400).json({ error: "Clé API OpenRouter manquante. Veuillez entrer une clé API valide." });
         }
 
+        if (incomingKey && !(await openRouterService.verifyApiKey(incomingKey))) {
+          return res.status(400).json({ error: "Clé API refusée par OpenRouter. Vérifiez que vous avez collé la clé complète (sk-or-v1-...)." });
+        }
+
         config = await storage.updateOpenrouterConfig(userId, finalData);
       } else {
         // Pour les créations, exiger tous les champs
@@ -1851,14 +1855,22 @@ export async function registerRoutes(app: Express): Promise<Server> {
           ...req.body,
           userId,
         });
+
+        if (!(await openRouterService.verifyApiKey(configData.apiKey))) {
+          return res.status(400).json({ error: "Clé API refusée par OpenRouter. Vérifiez que vous avez collé la clé complète (sk-or-v1-...)." });
+        }
+
         config = await storage.createOpenrouterConfig(configData);
       }
 
       // Don't send the API key back
       const { apiKey, ...safeConfig } = config;
       res.json(safeConfig);
-    } catch (error) {
+    } catch (error: any) {
       console.error("Error saving OpenRouter config:", error);
+      if (error.name === 'ZodError') {
+        return res.status(400).json({ error: error.errors[0]?.message || "Données invalides" });
+      }
       res.status(500).json({ error: "Failed to save OpenRouter config" });
     }
   });