Route credentialed traffic through MITM proxy

[winston-openai]

Summary

• synthesize internal MITM hooks from credentialed routes
• add credentialed-route hosts to the runtime proxy allowlist
• rewrite matching HTTPS requests to the Codex backend credential route proxy
• preserve generated routes across existing managed-proxy permission-profile refreshes

Validation

• just fmt
• cargo test -p codex-network-proxy
• just fix -p codex-network-proxy
• cargo test -p codex-core (blocked by existing untouched turn_extension_data errors in core/src/tasks/mod.rs)
• just fix -p codex-core (blocked by the same existing turn_extension_data errors)

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}