feat(cloud): support Anthropic provider base URL

openspec/changes/database-llm-provider-management/specs/cloud-planner-proxy/spec.md

@@ -6,7 +6,7 @@ credentials -- not any value supplied by the requesting Host Agent -- to
 resolve a planner-decision request to exactly one tool name and one arguments
 object, within the request's timeout. The endpoint SHALL resolve the active
 database-managed Provider profile for every request and use its provider,
-model, timeout, OpenAI-compatible base URL when applicable, and encrypted
+model, timeout, configured base URL, and encrypted
 cloud-held credential. It SHALL NOT read Cloud API planner Provider/model/
 timeout/API-key environment variables.
 

openspec/changes/database-llm-provider-management/specs/llm-provider-management/spec.md

@@ -4,9 +4,8 @@
 The Cloud Control Plane SHALL persist administrator-managed LLM Provider
 profiles with a unique name, provider type, model, timeout, enabled state,
 revision, and timestamps. A profile's provider type SHALL be either
-`anthropic` or `openai-compatible`; an OpenAI-compatible profile MAY specify
-an absolute HTTP(S) base URL and SHALL use the official OpenAI endpoint when
-it does not.
+`anthropic` or `openai-compatible`; either profile MAY specify an absolute
+HTTP(S) base URL and SHALL use its official provider endpoint when it does not.
 
 #### Scenario: Administrator creates an OpenAI-compatible profile
 - **WHEN** an authorized administrator submits a unique profile name,
@@ -15,6 +14,13 @@ it does not.
 - **THEN** the Cloud Control Plane persists an enabled profile with a new
   revision and returns its non-secret metadata
 
+#### Scenario: Administrator creates an Anthropic profile with a custom base URL
+- **WHEN** an authorized administrator submits a unique profile name,
+  `anthropic` provider type, model, valid timeout, API key, and a valid
+  Anthropic-compatible base URL
+- **THEN** the Cloud Control Plane persists the normalized URL with the profile
+  and returns its non-secret metadata
+
 #### Scenario: Invalid profile configuration is rejected
 - **WHEN** an administrator submits an unsupported provider type, blank model,
   non-positive timeout, duplicate name, or invalid base URL
@@ -81,6 +87,12 @@ reconfiguration.
   tool-calling request to that base URL using the profile's decrypted API key
   and returns the resulting single tool-call decision
 
+#### Scenario: Active Anthropic profile is used with a custom base URL
+- **WHEN** the active profile is Anthropic and includes a base URL
+- **THEN** the Cloud Control Plane makes the existing Anthropic native
+  tool-calling request to that base URL using the profile's decrypted API key
+  and returns the resulting single tool-call decision
+
 ### Requirement: Cloud planner Provider configuration is database-only
 The Cloud Control Plane SHALL resolve Cloud planner Provider, model, timeout,
 base URL, and API key from the active database profile and SHALL NOT read