Handle Codex image routes without proxy token

[jacobcxdev]

Summary

• Added Codex image route forwarding for both /images/* and /v1/images/*.
• Kept image requests outside local proxy token auth while still forwarding Codex account headers upstream.
• Centralised invalid token rejection so diagnostics stayed consistent across proxy routes.
• Added coverage for image forwarding, POST-only enforcement, and unknown-path auth diagnostics.

Testing

• Added unit tests for Codex image routing and invalid-token diagnostics.
• Not run (not requested).