chore(compliance): drop opencode zen free-pool from default config and docs

opencode.ai/zen is a free-quota pool for the official opencode app, keyed by
User-Agent fingerprint. Auto-provisioning it in the default config effectively
impersonated the official client to bypass FreeUsageLimitError — a ToS risk.
- default config (Go + GUI embed) now ships NO sources; users add their own
- README/README_EN: remove opencode adapter from built-in list and the zen
  free-pool paragraph
- adapter script and its unit tests stay (explicit opt-in only)

README_EN.md

@@ -77,7 +77,7 @@ GOMODCACHE=... GOPROXY=off go build -tags luajit -o llmsproxy ./cmd/llmsproxy
 > **No config is shipped in the repo** (config files carry real keys). On
 > first run the binary generates a default config at the `-config` path: a
 > random admin key (printed to the startup log), loopback-only `127.0.0.1:8080`,
-> and a keyless opencode zen source ready to chat. Rotate the admin key in the
+> and a keyless source ready to chat. Rotate the admin key in the
 > WebUI after first login.
 
 ```bash
@@ -289,19 +289,12 @@ Shared helpers: `hmac_sha256_hex(key, data)`, `sha256_hex(data)`,
 ### Built-in adapters
 
 `openai` `deepseek` `anthropic` `gemini` `github` `groq` `mistral` `ollama`
-`kimicode` `opencode`.
+`kimicode`.
 
 `anthropic`/`gemini`/`ollama` include multimodal conversion
 (`image_url` → their native format); with `disable_thinking` the `deepseek`
 adapter sets `extra_body.thinking.type` to `disabled`.
 
-**opencode** targets the opencode.ai zen free pool
-(`https://opencode.ai/zen/v1`): zen fingerprints clients by User-Agent and
-routes non-official UAs (curl, Go's default) into an anonymous pool that
-hits `FreeUsageLimitError`. The adapter always sends the opencode client UA;
-combined with `api_key: "public"` (the keyless official client actually sends
-`Bearer public`) it gets the free pool, e.g. `deepseek-v4-flash-free`.
-
 **kimicode** demonstrates `build_headers`: the cloud validates the calling
 app, so you HMAC-sign timestamp+URL+body with `meta.app_secret` and add
 `X-App-Sign`-style headers. Configure `sources[].meta.{app_id, app_secret,