Route LLM through FreeLLMAPI, wire up the three agents, deploy

[shikharsisodia7]

Replaces direct paid Anthropic calls with FreeLLMAPI, an OpenAI/Anthropic- compatible proxy over ~28 free tiers. The SDK stays; only base URL and auth change, so prompts, response parsing and token accounting are untouched.

LLM integration

• Add src/lib/agent/llm-client.ts as the single configured client. Selects FreeLLMAPI (ANTHROPIC_AUTH_TOKEN) or Anthropic direct (ANTHROPIC_API_KEY), forcing apiKey:null in proxy mode -- the SDK prefers x-api-key over the bearer token, so a stray key silently bypasses proxy auth.
• Replace the four raw ANTHROPIC_API_KEY gates with aiEnabled().
• Default every stage to the auto router on FreeLLMAPI; free models cost 0 so runs no longer accrue fake spend against budget caps.

Bug fixes

• HAIKU_MODEL was claude-haiku-3-5-20241022, not a real ID; detectSignals would have 404'd on every call.
• config.ts used ?? so an empty AGENT_DETECT_MODEL= blanked every model ID.
• generateBrief ignored its analysisModel argument and always used Sonnet.
• Gemini hard-threw a Phase 2 error; it now resolves through the proxy.
• company-run.ts charged a flat $0.01 per brief instead of real usage.
• Briefs arrived as truncated JSON at max_tokens 600; raised the ceiling and added salvageBriefFields() so partial JSON never reaches the UI.

The three agents (new: src/lib/agent/agents.ts)
Pricing, Filings and Hiring existed only as copy -- the local pipeline hashed pages and guessed a category from the URL, and the LLM diff only ran in the Supabase path. Each agent now claims its URLs and contributes a domain brief to the diff prompt. Baselines are skipped, provider failures degrade to the heuristic result, and severity may be raised but not dropped below what the change class warrants.

Intel extraction
Nav chrome and marketing copy scored as competitor financials. Adds boilerplate rejection, sentence-boundary matching, a numeric-evidence requirement for financial categories, and a pricing category. 20 noisy highlights became 9 accurate ones on stripe.com.

UI

• The LIVE TICKERS panel returned a hardcoded fixture unconditionally, showing invented prices and insider trades beside real data. Demo-state only now.
• Fix 339 duplicate-key errors; scraped data repeats values the fixtures never did, so React was dropping and duplicating rows.

Deployment

• Serve src/lib/company/seed.json when the filesystem is read-only; writes raise ReadOnlyStoreError and return 503 rather than an unhandled 500. Vercel reports ENOENT for mkdir /var/task/.data, not EROFS.
• middleware.ts asserted Supabase env non-null and 500'd every /auth and /app request when unset.
• Remove the hourly cron (Hobby allows daily only) and add .vercelignore so local .data cannot shadow the seed.
• Delete orphaned CircuitBreaker.ts / AuditService.ts: untyped JS in .ts files, imported nowhere, 24 tsc errors that broke next build.

Typecheck and build are clean. Live at https://vigilante-eight.vercel.app