[BUG] Webview CSP allows injection through configured OpenRouter base URL #2460

The webview HTML builders put apiConfiguration.openRouterBaseUrl into the Content-Security-Policy meta tag.

A configured URL can contain CSP delimiters (;, quotes) or markup. A user who controls the setting can add directives such as script-src 'unsafe-inline'. An imported settings file from an untrusted source can do the same. Both the production and the HMR webview documents are affected.

The webview needs the OpenRouter origin in connect-src for only one reason. Three hooks in webview-ui/src/components/ui/hooks/ call fetch() from the webview:

• useOpenRouterKeyInfo (/key)
• useOpenRouterModelProviders (/models/{id}/endpoints)
• useRequestyKeyInfo (Requesty x/apikey)

Expected behavior

The CSP never contains a value from user configuration. The webview sends no provider requests. The extension host makes them.

Fix

1. Add a requestProviderInfo message and a providerInfo reply that carries a request ID.
2. Move the three fetches, with their zod schemas, into src/core/webview/providerInfoHandler.ts. The handler reads the API key and base URL from the message, because Settings sends unsaved values.
3. Give each host fetch a 10 second timeout. Return a generic error to the webview, without the configured URL.
4. Change the three hooks to send the message and wait for the reply. Callers keep the same hook signatures and fallbacks.
5. Remove the OpenRouter and Requesty origins from connect-src in both HTML builders. The helper that parsed the OpenRouter origin is no longer needed.

Tests

• Both HTML builders keep a configured endpoint out of the CSP.
• The host handler accepts each valid kind and rejects unknown kinds, including __proto__.
• The host handler returns null or an empty record for missing keys, bad schemas and image-output models.
• The webview helper ignores replies for other request IDs and times out.

Fix in progress: PR #2422.