feat(proxy): add opportunistic traffic class

[Komzpa]

Summary

• Add API-key traffic_class with foreground default and opportunistic routing.
• Add Codex opportunistic admission preflight at /backend-api/codex/opportunistic/admission.
• Return OpenAI-style 429 denials with Retry-After when the opportunistic burn window is closed.
• Add dynamic opportunistic burn floors for burn_first, normal, and preserve accounts.
• Route real opportunistic Codex requests through the existing Codex proxy path while keeping Fixer-style preflight as a scheduling hint.
• Split sticky reallocation thresholds for primary and secondary budget windows.
• Apply account health-tier filtering before routing-policy selection so unhealthy accounts cannot win manual/opportunistic routing.
• Preserve additional-quota usage when stale standard-quota resets clear only the standard window.
• Keep foreground routing falling through from exhausted burn_first accounts to usable normal/preserve accounts instead of surfacing a global no_accounts 503.

Stack

• Depends on feat(accounts): add manual routing policy #553 for manual account routing policies and additional-quota routing policy overrides.
• fix(proxy): narrow budget-safe gate to primary usage #561 is already merged and covered the immediate budget-safe availability/health fixes.
• Merge order for [design] Reconsider budget-safe routing gate vs health-tier overlap and per-window thresholds #578 closure is feat(accounts): add manual routing policy #553 first, then this PR.

Together with #553 and the already-merged #561, this addresses #578.

Live regression note

A live-stack deployment from an older local working copy reproduced the failure mode this PR now guards: all burn_first accounts were exhausted for the weekly window while a preserve account still had usable capacity, and foreground Codex requests received 503 no_accounts with Rate limit exceeded. The PR branch contains test_budget_safe_selection_falls_back_when_burn_first_unavailable to keep that fallback behavior covered.

Validation

• /home/kom/proj/codex-lb/.venv/bin/ruff check app/modules/proxy/load_balancer.py tests/unit/test_load_balancer.py
• /home/kom/proj/codex-lb/.venv/bin/python -m pytest -q tests/unit/test_load_balancer.py (98 passed)
• uv run --frozen pytest tests/unit/test_load_balancer.py tests/unit/test_select_with_stickiness.py tests/integration/test_settings_api.py tests/integration/test_migrations.py -q (146 passed, 3 skipped)
• uv run --frozen ruff check .
• uv run --frozen ruff format --check .
• uv run --frozen ty check app tests
• codex review --base github/main completed clean after the health-tier and additional-quota review fixes.
• GitHub Actions on 6af32ede are all green and the PR is mergeable/clean.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c21f58874b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Treat preserve capacity as foreground in zero-burn eligibility

The zero-burn guard for normal/burn-first accounts only counts preserve peers when _preserve_allows_opportunistic_burn(...) returns true. That conflates “foreground capacity exists” with “preserve is also opportunistically burnable”: a preserve account at its opportunistic floor can still retain foreground reserve, but this code treats it as unavailable and blocks draining expendable accounts to zero. As a result, opportunistic admission can close earlier than intended whenever the only remaining foreground reserve is on preserve accounts.

Useful? React with 👍 / 👎.

[Komzpa]

Closing this draft because the opportunistic traffic class work was split into reviewable replacement PRs: #657 for the core traffic-class behavior and #659 for independent sticky-threshold settings. The active stack should use those split PRs.