feat(adapter): move per-source error condensing into transform_error hooks

Every upstream formats errors differently, which is adapter territory:
the protocol gains an optional transform_error(status, body) hook and all
built-in adapters implement their own envelope parsing (zen free-pool
labels, anthropic/gemini/ollama/mistral shapes, sensenova quota notes,
agentrouter WAF pages). The core keeps a single uniform fallback: when no
hook yields a reason clients get "api error <status>: unknown error" and
the raw body goes to server logs only.

internal/lua/adapters/agentrouter.lua

@@ -108,4 +108,19 @@ function adapter.transform_stream_chunk(raw_chunk)
     return json.encode(unified)
 end
 
-return adapter
+-- 错误收敛：前置 WAF 会返回整页 HTML（阿里云盾），JSON 时为 new-api 风格
+function adapter.transform_error(status, body)
+    local low = string.lower(body or "")
+    if string.sub(low, 1, 9) == "<!doctype" or string.find(low, "<html", 1, true) then
+        return "blocked by AgentRouter WAF"
+    end
+    local ok, resp = pcall(json.decode, body)
+    if not ok or type(resp) ~= "table" then return nil end
+    local e = resp.error
+    if type(e) == "table" and type(e.message) == "string" then
+        return e.message
+    end
+    return nil
+end
+
+return adapter