feat(upstreams): add optional Responses API-key providers

[KaynXu]

Teams can retain Codex OAuth accounts while routing selected existing Pool keys to a Responses API provider. This adds explicit encrypted API-key credentials, model discovery, existing policy-based model enforcement and token accounting. For example, an unchanged client requesting an OpenAI model can be assigned a provider model by its key policy; responses and accounting identify the actual provider model.

The adapter bridges native WebSocket clients to provider HTTP/SSE, translates namespaced/custom tools, reconstructs incremental history in a bounded key-isolated RAM cache, and supports client-carried encrypted compaction summaries. API credentials are excluded from Codex quota and OAuth refresh flows. Provider headers are restricted, redirects are disabled, and missing provider prices remain unpriced. Existing Codex behavior is retained. Import currently uses the operator-scoped Elixir API documented in the new operator guide.

Validation on the current upstream main (6b514123):

• Release image build passed, including warnings-as-errors compilation, compile-connected xref, asset build and release assembly.
• Strict Credo and formatting checks passed across 1,617 source files.
• Documentation checks and the complete documentation build passed.
• 112 affected routing, streaming, catalog, authentication and Responses API tests passed. The final transport-conflict resolution was separately covered by 18 focused tests.
• Full application suite: 9,371 tests passed initially. Nine failures came from the disposable test image retaining its temporary database name and omitting two documentation fixtures; after correcting that isolated environment, all nine reran and passed. 66 Unix integration tests remain excluded from the ordinary suite as configured by the repository.
• Live DeepSeek deepseek-flash probes verified streaming, image input, tool/result continuation, and a real Codex client file write/read completion.
• The committed tree was scanned for the live provider credential and deployment-specific identifiers; neither is present.

Known limitations:

• Native compaction authority depends on an upstream WebSocket lifecycle. API providers use HTTP; Codex Desktop can retry and fall back to HTTP during compaction. This is not complete native compaction protocol equivalence.
• Continuation cache is node-local, volatile and bounded (128 responses / 256 MiB / 30-minute idle TTL); missing history requires a full-history retry. Multi-node deployments need sticky routing.
• Continuation IDs and opaque compaction state are provider-specific. Switching an existing task between Codex OAuth and a third-party provider can require a new task, particularly after compaction or cache expiry.
• Existing OpenAI-encrypted compaction history cannot be decrypted. Provider-hosted tools and unrelated audio/file APIs are outside this adapter.

The GitHub Actions workflow for this fork contribution is awaiting maintainer approval before it can start.