feat: consolidate live session fixes and Responses compatibility

[Biaogo94]

Summary

This PR consolidates the live-verified Freebuff2API fixes into a single branch instead of splitting them across multiple PRs.

It combines:

• model-bound free session handling
• token disablement after upstream banned responses
• session/run reset handling for session_model_mismatch
• OpenAI Responses API compatibility
• Responses developer role compatibility

Changes

• add POST /v1/responses
• convert Responses input/tool payloads into the existing chat-completions upstream format
• support in-memory previous_response_id replay
• translate non-stream and stream responses into OpenAI Responses objects/events
• accept Responses developer role and map it to upstream system semantics
• disable tokens from rotation when upstream returns banned status
• invalidate and rotate session/run state when upstream returns session_model_mismatch
• keep the waiting-room / model-bound session behavior required by current Freebuff traffic

Why

The live service needs both layers together:

• Responses compatibility is needed for Codex/OpenAI-style clients
• Freebuff upstream session handling fixes are needed to avoid model-switch failures and banned-token reuse

Keeping these fixes split makes the codebase drift from production behavior and creates unnecessary PR churn.

Validation

• go test ./...
• live deployment verified:
  • /v1/responses non-stream works
  • /v1/responses stream works
  • Responses developer role works
  • switching from z-ai/glm-5.1 to minimax/minimax-m2.7 no longer leaks session_model_mismatch