fix(ai): Cerebras is not a free vendor, and its pinned model does not exist

[catomean]

Cerebras was listed in free-vendors.ts on the strength of an unkeyed 403 and a note claiming "free tier with per-minute budgets larger than Groq". Both were wrong. A real key settled it:

cerebras.ai/pricing — Developer tier:

"Self-serve pay-as-you-go with free $5 credit to start"

model	input	output
gpt-oss-120b	$0.35/M	$0.75/M
qwen-3.8-27b	$0.99/M	$1.49/M

With a real key:

GET  /v1/models           -> 200   gemma-4-31b, gpt-oss-120b, qwen-3.8-27b
POST /v1/chat/completions -> 402   {"code":"payment_required",
                                    "message":"Payment required to access this
                                    resource. Visit your billing tab."}

The catalogue answers while every completion is refused. That's exactly the shape that makes an unkeyed probe look like a pass: 403-without-a-key proved the host existed, and never proved anyone could be served. The bar this file sets — "probed unkeyed, answers 401/403" — is necessary and was never sufficient.

The pinned id was wrong too. llama-3.3-70b isn't in the live catalogue above, so even a funded account would have 404'd on the first call.

Configured, it would have added a link that refuses every request: pure latency in front of a chain that exists for users with no key and no credits. That's the failure #1000 fixed for Groq, arriving from a different direction.

FREE_VENDORS is now empty — the honest state, not a gap

Nothing has cleared the bar. An empty list costs nothing (every consumer already skips a vendor with no key) and costs far less than an entry that turns each fallback into a guaranteed refusal.

Tests rewritten to stay meaningful while empty

The contract rules — env override read at call time, whitespace treated as absent — are properties of the code, not of any listed vendor. They now run against a fixture instead of being deleted along with the entry.

Pinned against the real list is what must not drift:

• FREE_VENDORS is empty
• Cerebras is in REJECTED_VENDORS
• buildPlatformProviders adds no cerebras link even with CEREBRAS_API_KEY set

Google stays "unverified, not rejected"

Its OpenAI-compat /v1beta/openai/models still answers 404 unkeyed, which cannot distinguish "absent" from "hidden behind auth". Its free tier is real per ai.google.dev pricing — "free input and output tokens", qualification "active project or free trial", no billing account — and worth wiring once someone with a key confirms the chat path. But not on a guess, which is the whole lesson here.

2995 unit tests pass, type-check, lint and file-size checks clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HJRuvHJEBd8t7iRA9Sb1iw