Add live provider test contracts

[mavam]

🔍 Problem

• Provider tests covered mocked behavior, but there was no CI path for validating real API-backed providers with GitHub Secrets.
• The default test suite still needs to stay fast, deterministic, and credential-free.

🛠️ Solution

• Add opt-in live API contracts for every API-backed provider capability, using env-var credentials and stable shape/content assertions.
• Split package scripts so npm test stays offline and npm run test:live runs selected live contracts sequentially.
• Add a separate secret-backed GitHub Actions live API job for manual, scheduled, and same-repository PR runs.
• Document local and GitHub Secret-backed live testing, including provider and capability filters.

💬 Review

• Focus on the provider/capability contract matrix, the missing-secret failure mode, and the CI trigger/fork behavior.
• The live tests intentionally avoid exact-output snapshots so provider ranking and generated text drift do not cause brittle failures.