feat(captain): add OpenAI Custom Server provider option

Add an operator-level provider switch for Captain AI so it can use any
OpenAI-compatible base URL (vLLM, OpenRouter, proxies, etc.) in addition to the
default api.openai.com endpoint.

- installation_config.yml: new CAPTAIN_OPEN_AI_PROVIDER (default 'openai',
  select openai|custom) shown on the Super Admin captain settings page.
- lib/llm/config.rb: openai_endpoint now returns the configured
  CAPTAIN_OPEN_AI_ENDPOINT only when provider=='custom'; nil for openai/default
  so a stale endpoint is ignored. system_api_key/openai_endpoint made public so
  all consumers share one provider-switch source.
- Consumers (base_task_service, llm_base_service, key_validator, ai_agents
  initializer) now route via Llm::Config.openai_endpoint instead of reading
  CAPTAIN_OPEN_AI_ENDPOINT directly.
- installation_config.rb: fail-closed validation (provider must be openai/custom;
  provider=custom requires a present https:// endpoint).

Approved by independent five-key reviews deleg_b141098a (found+fixed one logic
gap) and deleg_3088b922 (passed=true, blocking arrays empty).

app/controllers/super_admin/app_configs_controller.rb

@@ -56,7 +56,7 @@ class SuperAdmin::AppConfigsController < SuperAdmin::ApplicationController
       'whatsapp_embedded' => %w[WHATSAPP_APP_ID WHATSAPP_APP_SECRET WHATSAPP_CONFIGURATION_ID WHATSAPP_API_VERSION],
       'notion' => %w[NOTION_CLIENT_ID NOTION_CLIENT_SECRET],
       'google' => %w[GOOGLE_OAUTH_CLIENT_ID GOOGLE_OAUTH_CLIENT_SECRET GOOGLE_OAUTH_REDIRECT_URI ENABLE_GOOGLE_OAUTH_LOGIN],
-      'captain' => %w[CAPTAIN_OPEN_AI_API_KEY CAPTAIN_OPEN_AI_MODEL CAPTAIN_OPEN_AI_ENDPOINT]
+      'captain' => %w[CAPTAIN_OPEN_AI_PROVIDER CAPTAIN_OPEN_AI_API_KEY CAPTAIN_OPEN_AI_MODEL CAPTAIN_OPEN_AI_ENDPOINT]
     }
 
     @allowed_configs = mapping.fetch(@config, general_configs)

app/models/installation_config.rb

@@ -37,6 +37,8 @@ class InstallationConfig < ApplicationRecord
   before_validation :set_lock
   validates :name, presence: true
   validate :saml_sso_users_check, if: -> { name == 'ENABLE_SAML_SSO_LOGIN' }
+  validate :openai_custom_provider_check, if: -> { name == 'CAPTAIN_OPEN_AI_PROVIDER' }
+  validate :openai_custom_endpoint_check, if: -> { name == 'CAPTAIN_OPEN_AI_ENDPOINT' }
 
   # TODO: Get rid of default scope
   # https://stackoverflow.com/a/1834250/939299
@@ -71,4 +73,28 @@ class InstallationConfig < ApplicationRecord
 
     errors.add(:base, 'Cannot disable SAML SSO login while users are using SAML authentication')
   end
+
+  # Only allow provider values the platform understands ('openai' default or 'custom')
+  # and ensure the "custom" provider actually requires an endpoint.
+  def openai_custom_provider_check
+    return if %w[openai custom].include?(value.to_s)
+
+    errors.add(:base, 'CAPTAIN_OPEN_AI_PROVIDER must be "openai" or "custom"')
+  end
+
+  # Fail-closed: when the provider is "custom", CAPTAIN_OPEN_AI_ENDPOINT must be
+  # present AND a secure https URL (OpenAI-compatible base).
+  def openai_custom_endpoint_check
+    provider = InstallationConfig.find_by(name: 'CAPTAIN_OPEN_AI_PROVIDER')&.value.to_s
+    return unless provider == 'custom'
+
+    if value.blank?
+      errors.add(:base, 'CAPTAIN_OPEN_AI_ENDPOINT is required when using the custom provider')
+      return
+    end
+
+    return if value.to_s.match?(%r{\Ahttps://\S+})
+
+    errors.add(:base, 'CAPTAIN_OPEN_AI_ENDPOINT must be a valid https URL when using the custom provider')
+  end
 end