fix: OpenRouter model routing regression + project input validation

- resolve_model_provider: fix regression where OpenRouter model IDs like
  openai/gpt-5.4-mini had their prefix stripped, causing AIAgent to look
  for OPENAI_API_KEY (direct API) instead of routing through OpenRouter.
  All chats returned Connection lost for OpenRouter users. Fix: only strip
  prefix and use direct-API when config.provider explicitly matches that
  provider; pass full provider/model string through for openrouter.
- Project name: cap at 128 chars, reject empty after strip on create/rename
- Project color: validate ^#[0-9a-fA-F]{3,8}$ to prevent CSS injection
  via dot.style.background in sessions.js
- Remove 2 redundant sys.path.insert() calls in cron handlers

Tests: 214 passed, 23 pre-existing failures, 0 regressions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/config.py

@@ -343,12 +343,14 @@ def resolve_model_provider(model_id: str):
 
     if '/' in model_id:
         prefix, bare = model_id.split('/', 1)
-        # If prefix matches config provider, strip it
+        # If prefix matches config provider, strip it and use that provider directly
         if config_provider and prefix == config_provider:
             return bare, config_provider, config_base_url
-        # If prefix is a known direct-API provider, use it
-        # (base_url only applies when matching config provider)
-        if prefix in _PROVIDER_MODELS:
+        # If the config provider is openrouter (or unset/None), pass the full
+        # provider/model string through -- OpenRouter uses this as its model ID.
+        # Only strip the prefix and switch to a direct-API provider when the
+        # config is explicitly set to that direct provider.
+        if config_provider and config_provider != 'openrouter' and prefix in _PROVIDER_MODELS:
             return bare, prefix, None
 
     return model_id, config_provider, config_base_url