feat(openai): add group-level Codex client restriction

[LichKing-2234]

Summary

• add OpenAI group field codex_official_only with migration, Ent schema, DTO/API cache/admin request support
• align OpenAI Codex group restriction with Anthropic Claude Code: non-official clients can fall back to a configured OpenAI group, and invalid/cyclic restricted fallback targets are rejected
• enforce the effective fallback group across OpenAI Responses, Chat Completions, Messages bridge, Embeddings, Images, and Responses WebSocket ingress
• move the admin UI to an Anthropic-matching Codex restriction block with tooltip, status text, fallback selector, and i18n text

Tests

• GOPROXY=https://goproxy.cn,direct go test ./...
• GOPROXY=https://goproxy.cn,direct go test -tags=unit ./internal/server -run 'TestAPIContract'\n- pnpm --dir frontend build\n- git diff --check

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[LichKing-2234]

I have read the CLA Document and I hereby sign the CLA