feat(proxy): add OpenAI Responses WebSocket support for Codex providers

Adds an `enableOpenaiResponsesWebsocket` system setting (default on) that lets
clients connect to `/v1/responses` over WebSocket. CCH accepts the upgrade via
a new custom Node server that wraps the Next.js handler, then tunnels each
client `response.create` frame through the existing HTTP proxy pipeline using
an `x-cch-client-transport: websocket` marker. For Codex providers — and only
Codex — the forwarder pre-flights an upstream WebSocket dial; on handshake
rejection or close-before-first-event it gracefully falls back to the existing
HTTP path while keeping the client WebSocket open. Fallbacks are recorded on
the decision chain (`responses_ws_attempted` / `responses_ws_fallback`) and do
NOT count toward provider/endpoint/vendor circuit-breaker accounting, mirroring
the existing `http2_fallback` isolation pattern.

Non-WebSocket clients, non-Codex providers, and all existing HTTP/SSE
behavior are unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>