feat(codex-image): 封装 GPT Image 2 图片接口并收紧错误处理

- 新增 openai:image 路由、planner 与 finalize，内部通过 Codex responses image_generation tool 执行生图

- 补充 Codex OAuth/header 兼容、图片 success report 本地处理与相关前后端/集成测试

- 禁止 chat/completions 使用 gpt-image-2，图片接口限制 n=1，并移除 Provider 模型页的图片能力开关

apps/aether-gateway/src/handlers/admin/provider/write/provider/create.rs

@@ -7,6 +7,7 @@ use crate::handlers::admin::provider::write::normalize::normalize_provider_type_
 use crate::handlers::admin::request::AdminAppState;
 use crate::handlers::admin::shared::normalize_json_object;
 use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogProvider;
+use serde_json::json;
 use std::time::{SystemTime, UNIX_EPOCH};
 use uuid::Uuid;
 

apps/aether-gateway/src/handlers/admin/provider/write/provider/endpoint.rs

@@ -20,12 +20,13 @@ pub(crate) fn build_admin_fixed_provider_endpoint_record(
         Some(provider.provider_type.as_str()),
     )
     .and_then(|(_, rules)| (!rules.is_empty()).then_some(serde_json::Value::Array(rules)));
-    let endpoint_config =
-        if provider.provider_type == "codex" && normalized_api_format == "openai:cli" {
-            Some(json!({ "upstream_stream_policy": "force_stream" }))
-        } else {
-            None
-        };
+    let endpoint_config = if provider.provider_type == "codex"
+        && matches!(normalized_api_format, "openai:cli" | "openai:image")
+    {
+        Some(json!({ "upstream_stream_policy": "force_stream" }))
+    } else {
+        None
+    };
     let now_unix_secs = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .ok()

apps/aether-gateway/src/handlers/admin/provider/write/provider/update.rs

@@ -7,6 +7,7 @@ use crate::handlers::admin::provider::write::normalize::normalize_provider_type_
 use crate::handlers::admin::request::AdminAppState;
 use crate::handlers::admin::shared::normalize_json_object;
 use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogProvider;
+use serde_json::json;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 pub(crate) async fn build_admin_update_provider_record(