fix(proxy): harden credential and request handling

[AndrewMoryakov]

Scope

Backend-only change. No product UI files are changed.

What changed

• preserve an existing ChatGPT OAuth bearer on Codex routes; replace an Anthropic bearer with the configured OpenAI key and also use that key when a Codex request has no Authorization header
• bound transformable request bodies to 16 MiB and return a provider-shaped 413 without forwarding oversized requests
• keep bypass and label-only JSON requests streaming by inspecting only a bounded clone, so they cannot reintroduce an unbounded arrayBuffer allocation
• retain usage telemetry for bypassed Codex JSON/SSE responses without mutating the forwarded request body

Regression coverage

• existing ChatGPT OAuth is preserved
• Anthropic credentials are never forwarded to Codex
• missing Codex authorization falls back to the configured server key
• oversized chunked transform and bypass requests are handled safely
• headerless JSON/SSE usage tracking remains covered

Validation

• pnpm vitest run tests/proxy-usage.test.ts --reporter=dot (70 passed)