A new special provider, type "shodan", routes OpenAI-compatible requests to a
pool of open model endpoints (Ollama/vLLM/llama.cpp/...) that are auto-discovered
and validated in the background, failing over across them transparently. It is
credential-free by design: client credentials are never forwarded to the
(untrusted) discovered upstreams.

Discovery/validation/live-registry/failover engine is vendored, essentially
verbatim, from Pasquale Minervini's open-router project (@pminervini,
https://github.com/pminervini/open-router, upstream commit 0378a08); full credit
for that engine is his. See aisbf/providers/shodan/open_router_engine.py for
provenance/attribution and docs/shodan-provider.md. AISBF uses only the engine
(not its aiohttp server/CLI layer) via a small adapter (runtime.py, handler.py).

Rotation integration: a new general per-entry flag "last_resort: true" holds an
entry aside and engages it ONLY when every normal provider in the rotation is
unavailable (disabled/rate-limited — the case that otherwise returns HTTP 429)
or has failed during the request's retry loop. The flag works for any provider
type, not just shodan. The special model name "auto" routes to whatever the
discovery pool currently advertises.

- aisbf/providers/shodan/: vendored engine + runtime adapter + handler
- aisbf/providers/__init__.py: register 'shodan'
- aisbf/config.py: ProviderConfig.shodan_config
- aisbf/handlers.py: last_resort partition/engagement + shodan SSE streaming
- requirements.txt: aiohttp>=3.14
- docs/shodan-provider.md: usage, config, security, credit
- tests/providers/test_shodan_provider.py: 21 tests (routing failover,
  model resolution, config build, last_resort partition, singleton)

Full suite: 141 passed (providers + routes + license).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>