GEN-2824 add bounded bearer forwarding - #375

Current checkpoint — 7a4fdfad6577e62b85b10de52d735b521604f404

• Added a model-account reset race test: when the complete reset snapshot removes an account during an in-flight refresh cache write, the stale write is not retried and the local Codex cache is removed.
• Preserved existing model-account refresh serialization, concurrent edit recovery, key-generation rotation rejection, reset cache cleanup, and unlock reconciliation coverage.
• Kept changes scoped to packages/credential-proxy/test/model-account-lifecycle.test.mjs. PR GEN-2907 define run retention eligibility policy #396's runRetentionCleanup schema export is a separate additive change on that PR branch and is not included here; PR GEN-2824 add bounded bearer forwarding #375's existing proxy control credential schema export is preserved.

Validation on 7a4fdfad6577e62b85b10de52d735b521604f404

• Node 24.12.0 / npm 11.19.0; clean npm ci; isolated local PostgreSQL bootstrap; Playwright Chromium installed locally.
• Focused model-account lifecycle tests passed: 14/14.
• /usr/bin/time -p timeout --signal=TERM --kill-after=5s 590s npm test passed in 152.32 seconds: backend 92 files (595 passed/5 skipped); compiled app/API/PostgreSQL integration passed; Chromium functional 7 passed; app unit checks passed; proxy harness passed; credential proxy 58 passed; generated contracts, boundaries, docs, runtime, and dry-run deploy checks passed.
• git diff --check passed. Synthetic credentials and local services only; no live Fly/ChatGPT checks or production deployment.

Remaining acceptance work

• Continue broader model-account rotation/reset and refresh-persistence races.
• Complete Fly provisioning/execution and launch gating, integration management/API boundaries, packaging/docs, and broader end-to-end acceptance.
• Keep GEN-2824 In Progress and this PR draft until full acceptance and final validation pass. GitHub Build Manager owns asynchronous PR checks and merge-queue monitoring.