feat(proxy): add account-bound Codex upstream routing

[Soju06]

Summary

Recreates the #869 account-bound Codex upstream proxy routing work on top of current main as a clean, focused PR.

This intentionally supersedes the closed stacked PR #869 after its base branch was deleted when #868 merged. It does not use the broader #873 repair/consolidation branch, because #873 also mixes in #804 account OAuth proxy work and merge/consolidation commits.

Scope

• Adds account-bound upstream proxy routing for Codex/ChatGPT upstream HTTP and websocket traffic.
• Uses the curl_cffi async Codex upstream client with the built-in Codex CLI TLS fingerprint.
• Keeps route-required account-bound traffic fail-closed: no default pool, environment proxy, or direct fallback for bound routes.
• Preserves route metadata in request logs/audit paths and websocket handshakes.
• Adds settings validation for proxy pools/endpoints and route-related regression coverage.
• Includes OpenSpec change: openspec/changes/add-codex-proxy-pool-egress/.

What this excludes

• Excludes feat(accounts): add per-account OAuth proxy support #804 feature/account-egress-isolation / per-account OAuth proxy support.
• Excludes feat(proxy): add account-bound Codex upstream routing #873 repair/consolidation merge commits.

Validation

uv run openspec validate add-codex-proxy-pool-egress --strict
uv run openspec validate --specs
git diff --name-only origin/main..HEAD -- '*.py' | xargs uv run ruff check
git diff --name-only origin/main..HEAD -- '*.py' | xargs uv run ruff format --check
git diff --name-only origin/main..HEAD -- '*.py' | xargs uv run ty check
uv run pytest \
  tests/unit/test_auth_dependencies_upstream_proxy.py \
  tests/unit/test_auth_manager.py \
  tests/unit/test_codex_client.py \
  tests/unit/test_codex_upstream_paths.py \
  tests/unit/test_files_client.py \
  tests/unit/test_limit_warmup.py \
  tests/unit/test_model_fetcher.py \
  tests/unit/test_model_refresh_scheduler.py \
  tests/unit/test_proxy_utils.py \
  tests/unit/test_proxy_websocket_client.py \
  tests/unit/test_request_log_upstream_proxy_metadata.py \
  tests/unit/test_upstream_proxy_resolver.py \
  tests/unit/test_usage_client.py \
  tests/unit/test_usage_updater.py \
  tests/integration/test_oauth_flow.py \
  tests/integration/test_proxy_files.py \
  tests/integration/test_settings_api.py \
  tests/integration/test_migrations.py \
  -q
# 596 passed, 3 skipped

Supersedes #869.

[Soju06]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Soju06]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b1862c9bdc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Soju06]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Soju06]

@codex review

[Soju06]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".