fix(provider): honor ANTHROPIC_BASE_URL in native Anthropic provider

[rodboev]

Summary

The native anthropic provider ignores ANTHROPIC_BASE_URL, so local proxy or gateway setups still hard-route ChatAnthropic to https://api.anthropic.com even when SKILLSPECTOR_PROVIDER=anthropic and ANTHROPIC_API_KEY are set. This change makes the native provider honor an optional ANTHROPIC_BASE_URL, while keeping the default endpoint unchanged when the override is unset.

Closes #195

Root cause

src/skillspector/providers/anthropic/provider.py:50-55 currently resolves only ANTHROPIC_API_KEY and returns (api_key, None), and src/skillspector/providers/anthropic/provider.py:69-76 then instantiates ChatAnthropic with the module constant ANTHROPIC_BASE_URL every time. The surrounding provider flow already supports (api_key, base_url) tuples, as shown by src/skillspector/providers/openai/provider.py:52-58, src/skillspector/providers/__init__.py:56-67,95-101, and src/skillspector/llm_utils.py:47-59,88-99.

Diff Notes

• src/skillspector/providers/anthropic/provider.py
  • Read optional ANTHROPIC_BASE_URL alongside ANTHROPIC_API_KEY.
  • Thread the resolved override into ChatAnthropic, while preserving https://api.anthropic.com as the unset default.
• tests/unit/test_providers.py
  • Add regression coverage for native Anthropic credential resolution and for the instantiated client's resolved endpoint.
  • Clear ANTHROPIC_BASE_URL in the autouse provider fixture so default-endpoint assertions stay environment-independent.
• tests/unit/test_llm_utils.py
  • Update the provider-tier credential expectation only if needed to prove the Anthropic base URL now propagates through the active-provider path.
• tests/provider/test_provider_endpoint.py
  • Clear ANTHROPIC_BASE_URL before the live default-endpoint assertion so the native provider test stays pinned to Anthropic's default URL.
• README.md
  • Document ANTHROPIC_BASE_URL for the native anthropic provider in the provider matrix and env-var reference.

Scope

• Native anthropic only. No anthropic_proxy changes.
• ANTHROPIC_API_KEY remains the credential env var for the native provider.
• Default https://api.anthropic.com remains the behavior when ANTHROPIC_BASE_URL is unset.
• No changes to provider selection, fallback order, OpenAI provider env vars, or unrelated provider contracts.

Verification

• python -m pytest tests/unit/test_providers.py tests/unit/test_llm_utils.py - passed, 55 passed, 9 skipped.
• python -m pytest tests/unit/test_providers.py tests/unit/test_llm_utils.py with ambient ANTHROPIC_BASE_URL=http://ambient.example/v1 - passed, 55 passed, 9 skipped, confirming the new test-isolation fixes.
• uv run ruff check src/ tests/ - passed.
• uv run ruff format --check src/ tests/ - still reports pre-existing out-of-scope files: src/skillspector/nodes/analyzers/static_runner.py, tests/nodes/analyzers/test_binary_and_pe3_filtering.py, tests/nodes/analyzers/test_mp2_regex_backtracking.py, and tests/nodes/test_llm_analyzer_base.py.
• Optional live-provider evidence: python -m pytest tests/provider/test_provider_endpoint.py currently deselects under the repo's provider marker setup in this environment, so it was not needed for this branch's proof.
• CI Lint & Test (Python 3.12), Lint & Test (Python 3.13), and DCO Check - pending.

Notes

• PR feat(provider): add anthropic_proxy provider for Vertex-style raw-predict endpoints #128 clarified that anthropic_proxy is a separate provider surface, so this fix stays inside the native anthropic path.
• PR feat: add Ollama, Azure OpenAI, and generic OpenAI-compatible providers #179 is relevant prior art for provider base-url handling on the OpenAI-compatible side.
• The focused Windows baseline on 2026-06-24 was python -m pytest -m "not integration and not provider" tests/, with 989 passed, 2 failed, 12 skipped, 26 deselected, and 6 xfailed in 6.60s. The existing failures were tests/nodes/test_meta_analyzer.py::test_rejected_finding_still_dropped and tests/nodes/test_meta_analyzer.py::test_low_confidence_finding_dropped.
• The branch also hardens two test consumers of the new provider behavior: the live native Anthropic endpoint test now clears ANTHROPIC_BASE_URL, and the unit-test autouse provider fixture clears that env var before default-endpoint assertions run.
• If the optional live provider test is used later, keep the credential values from local config out of the PR body, commit messages, and issue comments.

[rng1995]

Approving — adds optional ANTHROPIC_BASE_URL support, mirroring the existing OPENAI_BASE_URL override. resolve_credentials() now returns (api_key, base_url) and create_chat_model falls back to the default constant when unset. Same operator-controlled trust model as the OpenAI path, so no new exposure. Tests cover default vs. override base URL, the credential waterfall, and the live test correctly delenvs ANTHROPIC_BASE_URL so it still targets the real endpoint.

[rng1995]

[Automated SkillSpector Review]

Re-review: approved. The only commit after the prior approval is formatting-only normalization of static_runner.py and three tests. The approved ANTHROPIC_BASE_URL behavior is unchanged; focused provider/unit tests and ruff checks pass.