feat(codex-image): 封装 GPT Image 2 图片接口并收紧错误处理

- 新增 openai:image 路由、planner 与 finalize，内部通过 Codex responses image_generation tool 执行生图

- 补充 Codex OAuth/header 兼容、图片 success report 本地处理与相关前后端/集成测试

- 禁止 chat/completions 使用 gpt-image-2，图片接口限制 n=1，并移除 Provider 模型页的图片能力开关

apps/aether-gateway/src/executor/orchestration.rs

@@ -1,6 +1,7 @@
 use crate::ai_pipeline_api::{
     build_local_gemini_files_stream_plan_and_reports_for_kind,
     build_local_gemini_files_sync_plan_and_reports_for_kind,
+    build_local_image_sync_plan_and_reports_for_kind,
     build_local_openai_chat_stream_plan_and_reports_for_kind,
     build_local_openai_chat_sync_plan_and_reports_for_kind,
     build_local_openai_cli_stream_plan_and_reports_for_kind,
@@ -409,6 +410,41 @@ pub(crate) async fn maybe_execute_sync_via_local_gemini_files_decision(
     .await
 }
 
+pub(crate) async fn maybe_execute_sync_via_local_image_decision(
+    state: &AppState,
+    parts: &http::request::Parts,
+    body_json: &serde_json::Value,
+    body_base64: Option<&str>,
+    trace_id: &str,
+    decision: &GatewayControlDecision,
+    plan_kind: &str,
+) -> Result<LocalExecutionRequestOutcome, GatewayError> {
+    let plan_and_reports: Vec<LocalSyncPlanAndReport> =
+        build_local_image_sync_plan_and_reports_for_kind(
+            state,
+            parts,
+            body_json,
+            body_base64,
+            trace_id,
+            decision,
+            plan_kind,
+        )
+        .await?;
+    if plan_and_reports.is_empty() {
+        return Ok(LocalExecutionRequestOutcome::NoPath);
+    }
+
+    execute_sync_plan_and_reports(
+        state,
+        parts,
+        trace_id,
+        decision,
+        plan_kind,
+        plan_and_reports,
+    )
+    .await
+}
+
 pub(crate) async fn maybe_execute_stream_via_local_gemini_files_decision(
     state: &AppState,
     parts: &http::request::Parts,

apps/aether-gateway/src/executor/sync_path.rs

@@ -16,7 +16,7 @@ use crate::{AppState, GatewayError, GatewayFallbackReason};
 use super::{
     build_direct_plan_bypass_cache_key, execute_sync_plan_and_reports,
     maybe_execute_sync_via_local_decision, maybe_execute_sync_via_local_gemini_files_decision,
-    maybe_execute_sync_via_local_openai_cli_decision,
+    maybe_execute_sync_via_local_image_decision, maybe_execute_sync_via_local_openai_cli_decision,
     maybe_execute_sync_via_local_same_format_provider_decision,
     maybe_execute_sync_via_local_standard_decision, maybe_execute_sync_via_local_video_decision,
     maybe_execute_sync_via_plan_fallback, maybe_execute_sync_via_remote_decision,
@@ -83,6 +83,24 @@ pub(crate) async fn maybe_execute_via_sync_decision_path(
             LocalExecutionRequestOutcome::NoPath => {}
         }
 
+        match maybe_execute_sync_via_local_image_decision(
+            state,
+            parts,
+            &body_json,
+            body_base64.as_deref(),
+            trace_id,
+            decision,
+            plan_kind,
+        )
+        .await?
+        {
+            LocalExecutionRequestOutcome::Responded(response) => {
+                return Ok(LocalExecutionRequestOutcome::Responded(response));
+            }
+            LocalExecutionRequestOutcome::Exhausted(outcome) => exhausted = Some(outcome),
+            LocalExecutionRequestOutcome::NoPath => {}
+        }
+
         match maybe_execute_sync_via_local_decision(
             state, parts, trace_id, decision, &body_json, plan_kind,
         )