fix(proxy): require downstream auth for Codex OAuth

[elkimek]

Summary

Stacked security follow-up for NousResearch/hermes-agent#91199, isolated against its exact head bb23a98be19ce32d1c6ca3a6abf4306acf7d59db.

• keep the Codex proxy hard-bound to loopback
• require a downstream bearer before any Codex credential-pool lookup or upstream request
• protect both /health and /v1/*; unauthorized health checks cannot learn or mutate pool availability
• load the bearer from a bounded, owner-only regular file (0600 on POSIX)
• reject symlinks, wrong ownership, group/other permissions, empty/multiline/oversized tokens, and file-swap races
• compare client bearer bytes in constant time and never forward the client credential upstream
• enforce the same requirement through CLI and programmatic create_app / run_server paths
• document the client-auth boundary and CLI flag without claiming every provider accepts any bearer

The implementation carries forward the downstream bearer pattern from NousResearch#62510 while retaining NousResearch#91199's stronger credential-pool, exact-upstream, raw-byte, query, retry, and cleanup behavior.

Security invariant

Loopback constrains reachability; it does not prove caller authority on a multi-user host. Missing or incorrect client credentials return 401 proxy_auth_failed before Hermes reads credential-pool availability, resolves a bearer, or contacts the upstream.

Verification

• scripts/run_tests.sh tests/hermes_cli/test_proxy.py tests/hermes_cli/test_proxy_codex.py — 33 passed
• Ruff on touched Python — passed
• Python bytecode compilation — passed
• git diff --check — passed
• sabotage proof — disabling the forwarding auth guard makes the adversarial test return HTTP 200 instead of 401
• independent review finding reproduced and fixed — unauthorized /health calls now return 401 with zero is_authenticated() / get_credential() calls
• live CLI canary after the review fix:
  • unauthenticated /health — HTTP 401 proxy_auth_failed
  • authenticated /health — HTTP 200, upstream authenticated
  • authenticated /v1/responses — HTTP 200, response.completed, exact CODEX_PROXY_REVIEW_FIX_OK

No credential value, credential file, or production service change is included.

[elkimek]

Superseded by the direct replacement PR against the canonical upstream repository: NousResearch#92750. That PR preserves Chris Munn’s original authorship and includes this hardening on current upstream main.