fix(openai): inject WS Codex image bridge tool

[Kanshan03]

Summary

• inject image_generation tool and bridge instructions for Codex CLI WS ingress requests when image generation is allowed
• reuse image-generation permission result for WS image intent checks
• add targeted ingress WS test for the Codex image bridge

Test

• docker run --rm -v "$PWD/backend:/src:ro" -v sub2api-go-build-cache:/root/.cache/go-build -v sub2api-go-mod-cache:/go/pkg/mod -w /app -e GOPROXY=https://goproxy.cn,direct -e GOSUMDB=sum.golang.google.cn golang:1.26.3-alpine sh -c 'cp -a /src/. /app/ && go test -v -timeout=2m ./internal/service -run TestOpenAIGatewayService_ProxyResponsesWebSocketFromClient_InjectsCodexImageBridge -count=1'

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[Kanshan03]

I have read the CLA Document and I hereby sign the CLA

[Kanshan03]

recheck

[Kanshan03]

recheck