fix: require OAuth accounts for Codex models manifest

[cyeinfpro]

Summary

• add a Codex models-specific account selector that excludes non-OAuth accounts and OAuth accounts without a resolved access token
• preserve the existing group, priority, LRU, quota, and schedulability rules by passing the exclusions back through the normal OpenAI scheduler
• resolve shadow accounts through their OAuth parent credentials
• attach the selected account to the ops/access-log context
• return a clear 503 No available OpenAI OAuth accounts response when the group has no eligible manifest account

Root cause

Requests to /v1/models?client_version=... are routed to CodexModels. The handler previously used the generic SelectAccountForModel, which can select both OAuth and API Key accounts. FetchCodexModelsManifest then requires a ChatGPT Codex OAuth access token, so selecting an API Key account produced:

{
  "error": {
    "message": "account has no Codex backend access token",
    "type": "upstream_error"
  }
}

In a mixed OAuth/API Key group, repeated model-manifest requests therefore alternated between 200 and 502 depending on the selected account.

Validation

• go test ./internal/service -run 'Test(SelectCodexModelsAccount|FetchCodexModelsManifest)' -count=1
• go test ./internal/service ./internal/handler ./internal/server/routes -count=1
• go vet ./internal/service ./internal/handler ./internal/server/routes
• go test ./... -count=1

Regression coverage includes:

• an API Key account with a stale access_token field
• an OAuth account with no access token
• a valid OAuth account in the same group
• a shadow account using its OAuth parent's credentials
• a group with no eligible OAuth manifest account

Fixes #3995

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[cyeinfpro]

I have read the CLA Document and I hereby sign the CLA

[smartcmd]

lgtm