feat: expand providers and make native model discovery account-aware

[OnlineChef (ChefGroep)]

Summary

• Fetch the native Codex model catalog with the account OpenCodex can actually use, without rewriting ~/.codex/auth.json.
• Prefer an explicitly selected pool account, fall back from a dead physical main login to healthy pool credentials, and preserve the existing snapshot when live discovery cannot complete.
• Serve the same live native catalog through OCX's real GET /v1/models?client_version=... Codex client route, preserving authoritative context/reasoning metadata for newly rolled-out models.
• Admit authoritative native slugs returned by the current Codex catalog so new OpenAI model rollouts do not require a static OpenCodex whitelist release.
• Add first-class OpenAI-compatible presets for Cohere, FriendliAI, SambaNova, Nebius AI Studio, and Novita AI.
• Align the free-provider directory with the promoted Cohere and Nebius endpoints.

Root cause

activeCodexAccountId controls OpenCodex pool routing, but the physical Codex main credential remains ~/.codex/auth.json. Native catalog refresh could therefore stay pinned to a stale Desktop login even while another pool account was healthy.

Current Codex model discovery only needs the account Bearer token plus ChatGPT-Account-ID for GET /backend-api/codex/models?client_version=.... This PR uses that request contract directly instead of copying pool credentials into Codex's native auth store.

Safety boundaries

• No mutation or credential copying into ~/.codex/auth.json.
• Live catalog JSON is bounded and validated at the external boundary before it enters catalog assembly.
• Account fallbacks share one request deadline, so configured pool size cannot multiply an upstream stall.
• codexAccountPools: false remains a hard standalone boundary: pool credentials are not consulted.
• Upstream HTTP, body-read, invalid-shape, or auth failures degrade to the existing bundled/on-disk catalog path.
• Existing catalog callers retain behavior through defaulted appended parameters.
• Authoritative live native rows keep their upstream reasoning ladder; OCX does not synthesize extra tiers onto a newly rolled-out model.

Coverage

Regression coverage includes selected-pool preference, dead-main fallback, one shared fallback deadline, safe degradation on response-body failure, account-pool opt-out, authoritative new native slugs, live metadata preservation in the catalog builder, registry/free-tier parity, and a hermetic end-to-end server test that proves /v1/models?client_version=9.9.9 forwards the exact client version and account headers while returning the live native row.

Non-goals

This PR does not swap Codex Desktop/app-server login state, rewrite the native auth file, or fold the larger Codex/app-server lifecycle decoupling into the provider/catalog change.

The proxy already runs independently as its own service. Remaining Codex coupling is primarily lifecycle/integration: config/catalog injection and stale long-lived codex app-server consumers after disk catalog changes. Remote CLI endpoint/profile orchestration should be a separate PR built on the existing shared runtimeRequest(baseUrl) management client.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}