Point twin_doctor's isolated server at the twin

The provider probe runs inside the isolated server, which never sees the
test process environment. The test used to store `OPENAI_BASE_URL` in the
vault, and cd74013d0 dropped that entry without replacing it, so the
server probed the real OpenAI API with the namespace as its key and the
doctor reported the provider as failed. The server settings now repoint
the `openai` provider at the twin through the operator `[llm]` overlay.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

lib/apps/fabro-cli/tests/it/cmd/doctor.rs

@@ -103,6 +103,9 @@ enabled = false
     context.doctor().assert().success();
 }
 
+/// The provider probe runs inside the isolated server, which never sees the
+/// test process environment, so the twin's base URL reaches it through the
+/// operator `[llm]` overlay rather than `OPENAI_BASE_URL`.
 #[fabro_macros::e2e_test(twin)]
 async fn twin_doctor() {
     let mut context = test_context!();
@@ -123,8 +126,12 @@ strategy = "app"
 
 [server.sandbox.providers.docker]
 enabled = false
+
+[llm.providers.openai]
+base_url = "{}"
 "#,
-            toml_path(&storage_dir)
+            toml_path(&storage_dir),
+            twin.base_url,
         ),
     );
     seed_openai_vault(&storage_dir, &namespace);