feat(llm-wrapped): declaratively configured multi-provider llm CLI

[etrobert-bot]

Adds llm-wrapped — simonw's llm packaged with the repo's wrapped pattern so switching between model providers needs no imperative setup (no llm keys set, no hand-edited files in $HOME):

• OpenAI — OPENAI_API_KEY read at runtime from the agenix secret (/run/agenix/openai-api-key), env override wins; mirrors hass-cli-wrapped
• GitHub Copilot — store-sourced extra-openai-models.yaml routes copilot-gpt-4.1 / copilot-sonnet through the local copilot-api proxy (modules/copilot-api.nix, port 4141)
• Ollama — llm-ollama plugin baked in via llm.withPlugins

llm reads extra-openai-models.yaml from LLM_USER_PATH, which must stay writable (it holds logs.db), so the wrapper points it at ~/.local/state/llm and refreshes the store-sourced config there on every launch — the file stays declarative while state remains mutable.

Installed on workstations via modules/workstation.nix.

Verification (on tower)

• llm plugins shows llm-ollama; llm models list includes both copilot entries
• llm -m copilot-gpt-4.1 "Reply with exactly: copilot proxy works" → copilot proxy works (live, through the local proxy, no key needed)
• env -u OPENAI_API_KEY llm -m gpt-4.1-nano ... → answered, proving the key comes from the agenix secret at runtime
• Response log landed in ~/.local/state/llm/logs.db

Usage: llm -m copilot-gpt-4.1 "question", llm -m gpt-4.1 "question", llm -m llama3.2 "question" (with an ollama server running). llm models lists everything.

🤖 Generated with Claude Code