compute guard: line-scoped allow entries; allow MindKeychain.jsx's two OAuth endpoints only

Allow entries may carry matches: (regexes); then only matching lines are
allowed, so an allowed file can't smuggle in a new call. windy-pro #609
MindKeychain.jsx: openrouter.ai/auth? and /api/v1/auth/keys (BYOK key
acquisition via OAuth PKCE, no inference; successor of the MindPanel
allow, ADR-064). An inference call in the same file still flags (tested).
Orchestrator-approved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci/compute-guard-allow.yml

@@ -35,6 +35,13 @@ allow:
     paths: ["src/client/web/src/pages/panels/MindPanel.jsx"]
     reason: "Validates the USER's own OpenRouter key for BYOK (audit #10); spends no house money."
 
+  - repo: windy-pro
+    paths: ["src/client/web/src/pages/panels/MindKeychain.jsx"]
+    # ONLY these two endpoints: any other openrouter.ai call in this file (e.g.
+    # /api/v1/chat, i.e. inference) still flags. Orchestrator-approved 09-23.
+    matches: ['openrouter\.ai/auth\?', 'openrouter\.ai/api/v1/auth/keys']
+    reason: "BYOK key acquisition via OpenRouter OAuth PKCE; no inference; successor of MindPanel allow (ADR-064)."
+
   - repo: windy-git
     paths: ["scripts/compute_guard.py", "ci/compute-guard-allow.yml"]
     reason: "The guard's own pattern list and this file."