ci(ci): add OpenRouter API key secret to deploy workflow

.github/workflows/deploy.yml

@@ -54,8 +54,9 @@ jobs:
 
   # Deploys on every main push (not path-filtered): apps/api/data/schedule.json
   # is bundled at deploy time, and re-deploying an unchanged Worker is a no-op.
-  # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit) and
-  # CLOUDFLARE_ACCOUNT_ID.
+  # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit),
+  # CLOUDFLARE_ACCOUNT_ID, and OPENROUTER_API_KEY (the docs assistant's
+  # POST /ask; the Actions secret is the one copy, mirrored into the Worker).
   deploy-api:
     runs-on: ubuntu-latest
     steps:
@@ -68,6 +69,13 @@ jobs:
       # DST cron guards must hold before the Worker ships.
       - run: bun run api:test
 
+      - run: printf %s "$OPENROUTER_API_KEY" | bunx wrangler secret put OPENROUTER_API_KEY
+        working-directory: apps/api
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+
       - run: bun run api:deploy
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}