fix(runtime): scope OpenAI image proxy capability

[Yevanchen]

Summary

• grant official OpenAI runtime sessions a scoped gpt-image-2 capability
• admit only POST /images/generations and /images/edits
• require the granted model in JSON and multipart bodies before forwarding

Root cause

The runtime proxy grant covered the Responses model only, so valid Image API requests were rejected with 403 before reaching OpenAI.

Verification

• just test-file apps/api/tests/driver-llm-proxy-route.test.ts
• just test-file apps/api/tests/runtime-vendor-env-vars.test.ts
• just tc-package @mosoo/api
• just check reached 1080 passing tests; one unrelated macOS /var versus /private/var path assertion failed in apps/driver/tests/acp-file-system.test.ts

No migration or deployment. Incident record: #460.