feat(bridge): LlmProvider trait + OAuth-riding ChatGPT provider

Introduce an `LlmProvider` trait (the engine<->LLM seam, sibling to the
`Backend` harness<->engine trait) so inference can route to providers
beyond the Bifrost gateway. Two impls behind it:

- `BifrostClient` - existing OpenAI-compatible gateway (default).
- `OpenAiOAuthProvider` - rides the Codex CLI's ChatGPT login
  (`~/.codex/auth.json`) and drives `chatgpt.com/backend-api/codex/responses`
  (Responses API) with no API key. Self-refreshes the token (single-flight,
  write-back, CLI re-read fallback) and translates the engine's OpenAI-chat
  request to/from the Responses API + SSE accumulation.

Selected via `[bifrost] provider` ("bifrost" | "openai-oauth"). The engine
keeps speaking the existing ChatCompletionRequest/CompletionResult/
InferenceStrain currency, so all six inference call-sites are unchanged -
only the field type flips to `Arc<dyn LlmProvider>`.

Model ids are translated at the provider boundary (oauth/catalog.rs::resolve):
Bifrost-namespaced ids (`openai/...`, `-precision`) map onto served ChatGPT
models; `-fast` -> priority service tier.

Verified live to the wire level: builds+links, server boots in oauth mode
(reads the Codex token), and chatgpt.com accepts the request (auth, endpoint,
headers, payload all valid). The SSE->CompletionResult accumulation is NOT yet
verified against a successful completion (blocked by a subscription usage limit
at test time) - needs one live turn to confirm end-to-end.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

souveraine.example.toml

@@ -3,12 +3,25 @@
 
 # === BIFROST INFERENCE ===
 [bifrost]
+# Active provider implementation:
+#   "bifrost"      (default) — any OpenAI-compatible gateway via base_url below.
+#   "openai-oauth"           — ride the Codex CLI's ChatGPT login (run
+#                              `codex login` first); drives
+#                              chatgpt.com/backend-api/codex/responses with no
+#                              API key. base_url/api_key/virtual_key are ignored
+#                              in this mode; set primary_model to a ChatGPT model
+#                              (e.g. "gpt-5.5"). Bifrost-namespaced ids are
+#                              tolerated and mapped to the provider default.
+# provider = "bifrost"
+
 # Bifrost is the OpenAI-compatible API gateway
 base_url = "http://127.0.0.1:3360"
 api_key = ""  # Set via `souveraine auth set` or BIFROST_KEY env var
 virtual_key = ""  # x-bf-vk header if required by provider
 
-# Default model for conversation
+# Default model for conversation.
+# Bifrost mode: a gateway route like "openai/kimi-k2.6".
+# openai-oauth mode: a ChatGPT model like "gpt-5.5".
 primary_model = "openai/kimi-k2.6"
 
 # Request timeout in seconds for each LLM call attempt (default: 120).