Route sandbox provider requests through host authentication brokers

[fazxes]

Summary

• Route Gateway, Codex, and Grok requests through a configured host broker, including catalogs, permission review, credits, and usage lookup.
• Keep provider credentials and refresh in the host while the sandbox uses a scoped broker reference.
• Leave provider client-version discovery to the host for brokered requests.
• Reject incomplete broker configuration before making a network request.
• Preserve the actual HTTP status across inference, catalog, Vision, compaction, and permission failures.
• Direct authentication, access, and service-unavailability recovery to the host application across CLI, TUI, and ACP.
• Stop interrupted host-managed inference without replaying it or falling back to local credentials.
• Cancel the matching upstream request on in-session cancellation, even when a proxy retains the disconnected request.
• Report an unconfirmed upstream outcome when cancellation cannot be acknowledged within its bound.
• Keep local authentication and transparent host routing unchanged without broker configuration.