Fix Codex OpenAI API key proxy transform

[gakonst]

Summary

• change Codex OpenAI API-key proxy auth from header injection to placeholder replacement on Authorization
• assert Codex API-key auth contributes the OPENAI_API_KEY placeholder env

Evidence

• Live failure: sandbox pod logged repeated 401s to wss://api.openai.com/v1/responses while OPENAI_API_KEY was set to the literal placeholder
• Proxy auth logs showed no separate proxy-side secret-resolution failure

Tests

• cargo test -p centaur-iron-proxy harness_auth_fragments_are_baked_in
• cargo test -p centaur-api-server codex_app_server_env_template_injects_auth_mode_and_placeholder
• cargo fmt --check