Unify Codex setup and verify actual gateway borrowing

[HTExplicit]

Enabled borrowing could stop at the first failed target, leave later models unchecked, and display route preparation without proving that a real request used the route. This change unifies the Codex console and separates configuration, qualification, actual dispatch, and upstream completion.

• Replace the three sidebar entries with Setup & status, Client identity, and Advanced under /admin/codex; preserve old URL redirects and saved settings/identities. Existing configurations start with their editor folded, and complete identity/error details remain available.
• Share preparation by revision and finalized request identity, isolate caller cancellation, continue after per-target failures, and retain bounded request-specific proofs. Preserve the 230-second lease, finite preparation, account serialization, and existing routing/scheduling settings.
• Observe HTTP/SSE, pooled WS and native WS sends. Add an audited administrator comparison endpoint with a hard eight-request budget including preparation, compatibility sends, and configured WS prewarm; WS comparisons continue on their own sockets and release them afterward. Diagnostics reuse observation isolation and retain original results.
• Align the reference with ranxi v2.10.2: its five relevant fingerprint/borrowing core files are unchanged from v2.10.0; OAuth search-history compatibility is already supplied by the merged official v0.2.15 baseline. No schema migration is needed.

Validation: targeted Go coordination, cache, HTTP/WS comparison/continuation, configured prewarm accounting and handler preflight tests passed. The HTTP/WS integration cases and Vue typecheck passed again after rebasing onto v0.2.15. Focused frontend cases, lint, locale completeness, and desktop/390px Chinese/English browser checks passed; keyboard identity disclosure and diagnostic JSON download were verified with synthetic data. A focused CI race step covers the coordination changes because local Windows CGO is unavailable.

Production deployment and the authorized maximum of 20 real diagnostic requests follow normal required checks and the fixed release workflow. Qualification and reported model names are presented as observations, not proof of physical model identity or intelligence.