fix(token-spy): preserve catch-all query strings

[tang-vu]

Why this matters

Token Spy's authenticated catch-all is the compatibility path for provider endpoints it does not specialize. It forwarded method, path, body, and headers but silently removed every query parameter. Calls such as model listing or provider-specific operations could therefore target different upstream semantics than the client requested.

Root cause and invariant

proxy_other constructed url=f/{path} and never read the ASGI query string. The invariant is that an authenticated passthrough request preserves the raw encoded query component, including repeated keys, without changing the existing provider selection or header isolation.

The handler now appends scope[query_string] only when present, decoding the ASGI-defined ASCII bytes without parsing or normalizing them.

Overlap check

Searched open and closed PRs for token spy proxy query string, catch-all query passthrough, and ods/extensions/services/token-spy/main.py. Existing open changes cover decoded response headers (#2971), streaming status (#2970), usage bounds (#2969), atomic session files (#2803/#2798/#2795), Windows escaping (#2796), and exception narrowing (#2692/#2691). None changes catch-all URL construction.

Regression coverage

A new FastAPI boundary test sends an authenticated request with an encoded value and a repeated key, records the exact URL handed to the selected upstream client, and verifies the response still passes through.

Validation

• pytest -q ods/extensions/services/token-spy/tests/test_proxy_passthrough.py — 1 passed
• python -m py_compile ods/extensions/services/token-spy/main.py ods/extensions/services/token-spy/tests/test_proxy_passthrough.py
• git diff --check

Tradeoffs and rollback

Token Spy does not interpret query values; upstream remains responsible for them. Authentication headers stay isolated by the existing header builders. Reverting this commit restores the former query-dropping behavior without a data migration.

[tang-vu]

Batch compatibility receipt (2026-08-23)

Validated merge order: #2989 ? #2990 ? #2993 ? #2991 ? #2992 ? #2994 ? #2995 ? #2996 ? #2997 ? #2998. The changes are independently useful; this order only reconciles shared model-router and magic-link files.

Synthetic integration head: origin/batch/quality-ten-20260822-round2-integration at 91eb730d. The only textual conflict was the two model-router tests inserting at the same class boundary; the integration resolution retains both contracts. Magic-link changes merged cleanly.

Combined validation on that exact head:

• remote-provider egress contract: 16 passed
• Token Spy suites: 22 passed, 1 skipped (live PostgreSQL availability)
• model-router suite: 55 passed
• APE suite: 29 passed
• dashboard OAuth + magic-link suites: 118 passed, 2 platform skips
• Brave Search loopback E2E: all checks passed
• git diff --check: passed

All required GitHub checks are green across the batch. #2992 initially hit a transient openSUSE repository/mirror failure while installing rsync; a clearly labeled empty retry commit reran the unchanged tree, and openSUSE plus the full matrix passed.