WOR-52: canonical OpenCodex backend route model

[jhckevin]

WOR-52

Summary

• replace the legacy narrow backend config shape with a canonical OpenCodexBackendRoute discriminated union
• wire onboarding, settings, and backend control through one shared five-route backend editor
• preserve API-backed OpenHarness launch behavior while making subscription bridge routes explicit without faking unsupported host startup

Validation

• bun test ./src/shared/opencodex-backend-route.test.ts ./src/main/lib/opencodex/backend-config.test.ts ./src/main/lib/opencodex/backend-host.test.ts ./src/renderer/features/onboarding/opencodex-backend-config.test.ts
• bun test ./src/renderer/app-surface.test.ts ./src/renderer/opencodex-shell-contract.test.ts ./src/main/lib/opencodex/desktop-shell-contract.test.ts
• filtered bunx tsc --noEmit over the touched WOR-52 files; remaining hits are limited to missing local bun:test declarations in test files
• bounded bun run dev boot probe; Electron/Vite builds and exposes the renderer at http://localhost:5174/ before manual stop

Risks

• full repo bunx tsc --noEmit still has a large unrelated baseline outside the WOR-52 ownership zone
• subscription-route host launch remains intentionally deferred to the downstream launch-profile issue
• browser parity evidence is limited to the dev-boot probe; no Playwright interaction capture yet