gateway: OR_TIMEOUT_SECS env-overridable — 180s wall starved kimi_architect

The auditor's kimi_architect second pass (~180K-char prompt via
openrouter/moonshotai/kimi-k2.6) died at exactly the hardcoded 180s
client timeout on PR #14's drill audit, surfacing as 'error decoding
response body'. Ceiling now reads OR_TIMEOUT_SECS (default unchanged);
host drop-in sets 900s to match the auditor's own call budget.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/gateway/src/v1/openrouter.rs

@@ -20,7 +20,19 @@ use serde::{Deserialize, Serialize};
 use super::{ChatRequest, ChatResponse, Choice, Message, UsageBlock};
 
 const OR_BASE_URL: &str = "https://openrouter.ai/api/v1";
-const OR_TIMEOUT_SECS: u64 = 180;
+// Default request ceiling. 180s starves long-context calls (kimi_architect's
+// ~180K-char second pass died at exactly this wall on 2026-09-02, surfacing
+// as a misleading "error decoding response body") — override per host with
+// OR_TIMEOUT_SECS. The auditor budgets up to 900s client-side.
+const OR_TIMEOUT_SECS_DEFAULT: u64 = 180;
+
+fn or_timeout_secs() -> u64 {
+    std::env::var("OR_TIMEOUT_SECS")
+        .ok()
+        .and_then(|v| v.trim().parse::<u64>().ok())
+        .filter(|&s| s > 0)
+        .unwrap_or(OR_TIMEOUT_SECS_DEFAULT)
+}
 
 pub fn resolve_openrouter_key() -> Option<String> {
     if let Ok(k) = std::env::var("OPENROUTER_API_KEY") {
@@ -72,7 +84,7 @@ pub async fn chat(
     };
 
     let client = reqwest::Client::builder()
-        .timeout(Duration::from_secs(OR_TIMEOUT_SECS))
+        .timeout(Duration::from_secs(or_timeout_secs()))
         .build()
         .map_err(|e| format!("build client: {e}"))?;