fix(admin): add missing sanitize_model_id and sanitize_api_key delegators

The refactored orchestrator was missing public method delegations for
sanitize_model_id() and sanitize_api_key(), which tests call directly
on the Peptide_News_Admin instance and WordPress uses as register_setting
callbacks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

admin/class-peptide-news-admin.php

@@ -150,4 +150,31 @@ class Peptide_News_Admin {
 	public function render_cost_dashboard_page(): void {
 		$this->dashboard_pages->render_cost_dashboard_page();
 	}
+
+	/**
+	 * Sanitize and validate an OpenRouter model ID.
+	 *
+	 * Delegates to the settings class. Kept on the orchestrator because
+	 * WordPress register_setting() callbacks may reference $this.
+	 *
+	 * @param string $value Raw model ID from form input.
+	 * @return string Sanitized model ID or empty string on failure.
+	 */
+	public function sanitize_model_id( string $value ): string {
+		return $this->settings->sanitize_model_id( $value );
+	}
+
+	/**
+	 * Sanitize an API key value — encrypt if new, preserve if masked.
+	 *
+	 * Delegates to the settings class. Kept on the orchestrator because
+	 * WordPress register_setting() callbacks may reference $this.
+	 *
+	 * @param string $value       Raw API key from form input.
+	 * @param string $option_name The WP option being saved.
+	 * @return string Encrypted key or previous value if input was masked.
+	 */
+	public function sanitize_api_key( string $value, string $option_name = '' ): string {
+		return $this->settings->sanitize_api_key( $value, $option_name );
+	}
 }