Document OpenAI addition, scoped to RAG-grounded replies only

Unlike Lex (OpenAI primary for everything), Nox only routes to OpenAI
when a reply is actually grounded in retrieved document excerpts —
plain chat and live-data questions stay on the free Cloudflare tiers.
Real streaming, same as the Cloudflare path.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -132,6 +132,18 @@ with an 8s timeout so one slow provider can't stall the whole request. Scoped to
 text chat path only — the vision endpoint already degrades gracefully on its own and
 would need real separate per-provider multimodal handling to extend this to it.
 
+**OpenAI, scoped narrowly, unlike Lex**: `OPENAI_API_KEY` is set on this worker too, but
+tried first **only when the reply is genuinely grounded in retrieved document excerpts**
+(`ragChunksMeta.length > 0` — a document was actually uploaded and something relevant
+was found for this question), streamed via `callOpenAIStream` the same way Cloudflare's
+own reply streams. Plain chat and live-data questions never touch it and stay entirely
+on the free Cloudflare tiers regardless of which model tier the visitor picked — a
+deliberate choice to keep OpenAI's real cost scoped to where it was shown to matter most
+(synthesizing several retrieved excerpts faithfully) rather than all of Nox's traffic
+the way it ended up scoped for Lex. Capped at `OPENAI_DAILY_CALL_CAP = 200`/day
+(KV-tracked, separate from `DAILY_MESSAGE_CAP`), a smaller number than Lex's cap since
+this only fires for document-grounded replies, not every message.
+
 ### Everything else
 - **PWA**: installable, small app-shell cache via `sw.js` (network-first for
   `index.html` so a redeploy is visible immediately when online; falls back to cache