Bare `provider = "custom"` resolves its credential from a host-gated
candidate list and only forwards OPENAI_API_KEY when base_url points at
openai.com (upstream #28660 / GHSA-76xc-57q6-vm5m). For any other host it
substitutes the literal placeholder "no-key-required", so the llama
cluster answered 401. Use a named custom_providers entry with key_env,
which is not host-gated, and rename the env var to LLAMA_API_TOKEN.

The collab patch lived here and was applied twice (2configs/covibe.nix with the
collab-web SPA, tools/covibe without it), and the client wrapper hardcoded the
four covibe.lassul.us addresses in shell. covibe owns all of that now:

- 2configs/covibe.nix keeps only the deployment: ompPackage and webRoot come
from the module defaults (covibe.packages.${system}.omp and its SPA).
- tools/covibe passes the addresses to covibe-client.override; the CLI's own
COVIBE_* env fallbacks replace the shell script, and `covibe` in a project
directory still starts a session with arguments going to omp.
- covibe.inputs.llm-agents.follows = "llm-agents" keeps one omp revision, so the
patched omp derivation is unchanged (4nxafz2k…-omp-17.1.4.drv): no new build.
- 2configs/omp-collab-autostart.patch deleted (now covibe/nix/).