feat(llm): add LiteLLM provider — enum, client, tests, QA follow-ups

- Add LITELLM = "litellm" to LLMProviderType enum (already in HEAD from prev commit)
- Add comment in LLMClient.__init__ explaining standard Bearer auth for LiteLLM
- Add regression test test_provider_type_enum_values — guard against value drift
- Add test_litellm_client_uses_default_bearer_auth — verify no extra headers
- Clean up duplicate @RELATION lines in models.py
- All 20 backend + 4 frontend tests pass

backend/src/services/__tests__/test_llm_provider.py

@@ -22,6 +22,26 @@ os.environ.setdefault("ENCRYPTION_KEY", Fernet.generate_key().decode())
 # endregion _test_encryption_key_fixture
 
 
+# region test_provider_type_enum_values [TYPE Function]
+# @RELATION: VERIFIES -> [LLMProviderType]
+# @PURPOSE: Regression guard — prevent accidental value drift when enum variants are added or renamed.
+# @INVARIANT: Every LLMProviderType member must have a value matching its lowercase name.
+def test_provider_type_enum_values():
+    """Verify all LLMProviderType enum values match their expected strings."""
+    assert LLMProviderType.OPENAI.value == "openai"
+    assert LLMProviderType.OPENROUTER.value == "openrouter"
+    assert LLMProviderType.KILO.value == "kilo"
+    assert LLMProviderType.LITELLM.value == "litellm"
+    # If new providers are added, extend this list — enum value drift breaks string comparisons
+    # across executor.py, preview.py, ProviderConfig.svelte, and the DB layer.
+    expected_count = 4
+    assert len(LLMProviderType) == expected_count, (
+        f"Expected {expected_count} provider types, got {len(LLMProviderType)}. "
+        "If you added a new one, add its value assertion above and update expected_count."
+    )
+# endregion test_provider_type_enum_values
+
+
 # @TEST_CONTRACT: EncryptionManagerModel -> Invariants
 # @TEST_INVARIANT: symmetric_encryption
 # region test_encryption_cycle [TYPE Function]