fix(providers): kilo-gateway authType should be optional, not apikey (#10086)

Probed live: /chat/completions answers HTTP 200 with no Authorization
header (kilo-auto/free routed to stepfun/step-3.7-flash). A real key
still raises limits, so this matches the ovhcloud/pollinations pattern
of authType: "optional" rather than "apikey".

Fixes #10068

open-sse/config/providers/registry/kilo-gateway/index.ts

@@ -1,5 +1,10 @@
 import type { RegistryEntry } from "../../shared.ts";
 
+/**
+ * The key is genuinely optional: probed live 2026-08-11 with no Authorization
+ * header, /chat/completions still answered 200 (kilo-auto/free routed to
+ * stepfun/step-3.7-flash) — so authType stays "optional", matching ovhcloud.
+ */
 export const kilo_gatewayProvider: RegistryEntry = {
   id: "kilo-gateway",
   alias: "kg",
@@ -7,7 +12,7 @@ export const kilo_gatewayProvider: RegistryEntry = {
   executor: "default",
   baseUrl: "https://api.kilo.ai/api/gateway/chat/completions",
   modelsUrl: "https://api.kilo.ai/api/gateway/models",
-  authType: "apikey",
+  authType: "optional",
   authHeader: "bearer",
   models: [
     { id: "kilo-auto/frontier", name: "Kilo Auto Frontier" },

tests/unit/provider-credential-requirement.test.ts

@@ -18,6 +18,8 @@ test("classifies each credential model from the real registries", () => {
   assert.equal(getCredentialRequirement("kilocode"), "optional");
   // Verified live 2026-07-20: answers with no Authorization header, 403s on a bad key.
   assert.equal(getCredentialRequirement("ovhcloud"), "optional");
+  // Verified live 2026-08-11: HTTP 200 with no Authorization header (#10068).
+  assert.equal(getCredentialRequirement("kilo-gateway"), "optional");
   // OAuth: nothing to paste, but the user still signs in.
   assert.equal(getCredentialRequirement("agy"), "oauth");
   // Ordinary key-gated provider.