fix(openai): 修复 codex_cli_only 误拦截并补充 codex 家族识别

- 为 codex_cli_only 增加 originator 判定通道，避免仅依赖 User-Agent 误拦截
- 扩展官方客户端家族标识，补充 codex_chatgpt_desktop 等常见前缀
- 新增并更新单元测试与网关透传回归测试，覆盖 UA 与 originator 组合场景

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/internal/service/openai_oauth_passthrough_test.go

@@ -555,12 +555,14 @@ func TestOpenAIGatewayService_CodexCLIOnly_AllowOfficialClientFamilies(t *testin
 	gin.SetMode(gin.TestMode)
 
 	tests := []struct {
-		name string
-		ua   string
+		name       string
+		ua         string
+		originator string
 	}{
-		{name: "codex_cli_rs", ua: "codex_cli_rs/0.99.0"},
-		{name: "codex_vscode", ua: "codex_vscode/1.0.0"},
-		{name: "codex_app", ua: "codex_app/2.1.0"},
+		{name: "codex_cli_rs", ua: "codex_cli_rs/0.99.0", originator: ""},
+		{name: "codex_vscode", ua: "codex_vscode/1.0.0", originator: ""},
+		{name: "codex_app", ua: "codex_app/2.1.0", originator: ""},
+		{name: "originator_codex_chatgpt_desktop", ua: "curl/8.0", originator: "codex_chatgpt_desktop"},
 	}
 
 	for _, tt := range tests {
@@ -569,6 +571,9 @@ func TestOpenAIGatewayService_CodexCLIOnly_AllowOfficialClientFamilies(t *testin
 			c, _ := gin.CreateTestContext(rec)
 			c.Request = httptest.NewRequest(http.MethodPost, "/v1/responses", bytes.NewReader(nil))
 			c.Request.Header.Set("User-Agent", tt.ua)
+			if tt.originator != "" {
+				c.Request.Header.Set("originator", tt.originator)
+			}
 
 			inputBody := []byte(`{"model":"gpt-5.2","stream":false,"store":true,"input":[{"type":"text","text":"hi"}]}`)