feat(codex-image): 封装 GPT Image 2 图片接口并收紧错误处理

- 新增 openai:image 路由、planner 与 finalize，内部通过 Codex responses image_generation tool 执行生图

- 补充 Codex OAuth/header 兼容、图片 success report 本地处理与相关前后端/集成测试

- 禁止 chat/completions 使用 gpt-image-2，图片接口限制 n=1，并移除 Provider 模型页的图片能力开关

apps/aether-gateway/src/executor/orchestration.rs

@@ -1,6 +1,7 @@
 use crate::ai_pipeline_api::{
     build_local_gemini_files_stream_plan_and_reports_for_kind,
     build_local_gemini_files_sync_plan_and_reports_for_kind,
+    build_local_image_sync_plan_and_reports_for_kind,
     build_local_openai_chat_stream_plan_and_reports_for_kind,
     build_local_openai_chat_sync_plan_and_reports_for_kind,
     build_local_openai_cli_stream_plan_and_reports_for_kind,
@@ -409,6 +410,41 @@ pub(crate) async fn maybe_execute_sync_via_local_gemini_files_decision(
     .await
 }
 
+pub(crate) async fn maybe_execute_sync_via_local_image_decision(
+    state: &AppState,
+    parts: &http::request::Parts,
+    body_json: &serde_json::Value,
+    body_base64: Option<&str>,
+    trace_id: &str,
+    decision: &GatewayControlDecision,
+    plan_kind: &str,
+) -> Result<LocalExecutionRequestOutcome, GatewayError> {
+    let plan_and_reports: Vec<LocalSyncPlanAndReport> =
+        build_local_image_sync_plan_and_reports_for_kind(
+            state,
+            parts,
+            body_json,
+            body_base64,
+            trace_id,
+            decision,
+            plan_kind,
+        )
+        .await?;
+    if plan_and_reports.is_empty() {
+        return Ok(LocalExecutionRequestOutcome::NoPath);
+    }
+
+    execute_sync_plan_and_reports(
+        state,
+        parts,
+        trace_id,
+        decision,
+        plan_kind,
+        plan_and_reports,
+    )
+    .await
+}
+
 pub(crate) async fn maybe_execute_stream_via_local_gemini_files_decision(
     state: &AppState,
     parts: &http::request::Parts,