Support custom providers across all harnesses

[wsr3005]

Summary

• let organization admins configure encrypted OpenAI- and Anthropic-compatible custom providers, model aliases, upstream model mappings, and text/image input capabilities from Admin
• route custom models through Pi, OpenCode, and Codex, including bounded one-request paid self-tests with durable receipts and verifiable latency, streaming, model, usage, and egress metadata
• harden provider rollout, worker lifecycle, Postgres startup and drain behavior, deployment secret propagation, and Codex Responses compatibility without silently falling back to default providers
• version persisted provider capabilities so blue-green mixed releases fail closed and historical unknown fields cannot bypass rollout gates

Screenshots

Captured against local synthetic providers. The screenshots contain no real endpoint, credential, organization, or user data.

Verification

• affected custom-provider, route, wiring, Pi, OpenCode, Codex, and Admin tests: 123/123 pass
• installed OpenCode 1.17.18 regression proves a valid image reaches a controlled Responses endpoint
• root and Admin typecheck, ESLint, Oxlint, Prettier, and git diff --check pass
• manual synthetic Admin QA proves provider validation, write-only key display, model mapping, input modality entry, and Pi/OpenCode/Codex selector availability
• independent fresh-context review found and closed two mixed-version schema bypasses, then reported no remaining P0/P1/P2
• controlled real-endpoint QA with gpt-5.6-luna proves streaming, exact requested/response model, usage, image forwarding, and multi-turn context through Pi, OpenCode, and Codex without default-provider egress
• controlled real-endpoint tool QA proves execute-tool completion in OpenCode and Codex and an unambiguous memory-tool round trip in Pi; Pi did not reliably select requested execute arguments with this model, so that combination is not claimed as accepted

Safety boundaries

• every Admin self-test caps output at 128 tokens, disables automatic provider retries, and records one upstream request
• self-test results omit response text, raw credentials, and raw endpoint URLs
• custom Codex traffic uses a loopback proxy that strips only the unsupported internal Responses Lite header, bypasses ambient outbound proxies for loopback, and aborts upstream generation when the downstream request closes
• real-endpoint evidence was gathered with a controlled proxy and paid requests; no credential or endpoint value is included in this PR

[wsr3005]

The latest head is mergeable and has completed fresh local affected validation, typecheck, lint, formatting, and independent review. GitHub still shows the fork workflow as awaiting maintainer approval with no jobs started. When convenient, could a maintainer approve the workflow run?

[time-attack]

Thanks for this, @wsr3005 — and sorry for the slow response.

We're closing this PR. Per CONTRIBUTING.md, since coding agents write most of the underlying code now, we'd rather receive feature ideas as a short human-written note in adrs/ — informal is great, just the idea in your own words — and bugs as a plain issue. If we're aligned we're happy to burn our own tokens on the implementation, and we'll credit you as co-author.

We don't want your idea to get lost, so we've captured it in #728 to triage on our side. Please feel free to open an adrs/ note if you feel strongly about the approach. Appreciate you engaging with the repo!