feat(proxy-logs): keep the HTTP status the provider actually returned

[maxmad64bis]

⚠️ base-red inherited: #12732

Summary

The proxy log collapsed every outcome into success/timeout/error, so a throttled egress IP (429), a refused one (403) and a provider outage (500) read as the same line. result.status can't fill the gap: several 429s are generated locally (rate limiter, quota sharing, backpressure) before any request leaves.

Each proxy_logs row now keeps upstream_status, the status of the last response the patched fetch received while a provider request was dispatched, or null when no response arrived. The textual status column is untouched, so existing filters return the same rows.

Related Issues

• Related to [BUG] OpenCode Free: Missing Proxy Pool UI and lack of explicit account/proxy rotation logs in UI #5217 (reuses the applied-proxy sink it added)
• Related to feat(proxies): show how many egress IPs actually served a proxy pool #13581 (both raise a file-size cap, see Reviewer Notes)

Validation

• Change type: DB
• Focused tests and category gates from the golden path
• npm run lint — ESLint clean on the touched files; the full run is red on the base
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/upstream-status-capture.test.ts (8 tests): wrapper alone — dispatched call recorded, response untouched; outside dispatch ignored; throw clears; late response after dispatch end ignored; args forwarded; no sink harmless; isProviderRequestCaptureActive true only until runWithCapture settles; second dispatch without fetch leaves nothing stale.
• tests/unit/proxyfetch-upstream-status-capture.test.ts (9 tests): real patched fetch over local HTTP — 429 captured; last response wins; background fetch still running at dispatch return keeps 429; side fetch keeps provider status; network error on next dispatch clears; explicit-dispatcher path; direct-context path; no sink harmless; second dispatch without fetch leaves nothing stale.
• tests/unit/proxy-logs-upstream-status.test.ts (4 tests): column after migration + reconciler restore; memory/SQLite/export; absent → null never 0; textual filters unchanged.
• tests/unit/merge-applied-proxy-sink.test.ts (8 tests): withUpstreamStatus/mergeAppliedProxySink; safeLogEvents forwards; local 429 without fetch → null.
• Regression: 224 files, 1716 pass; only inherited failures (chatcore-hierarchical-admission, error-public-boundaries-hardening, proxyfetch-direct-response-start-timeout-10214 in batch, green alone).

Coverage Notes

• open-sse/utils/upstreamStatusCapture.ts (new): covered by the 8 wrapper tests, including the second-dispatch invalidation and the settled-dispatch exclusion.
• open-sse/utils/providerRequestLogging.ts (isProviderRequestCaptureActive, dispatch entry hook): covered by the capture tests plus transitively by every proxyfetch test running through the real runWithCapture.
• open-sse/utils/proxyFetch.ts (wrapper install only, +4): covered by the 9 real-fetch tests (sentinel, explicit dispatcher) plus the untouched proxyfetch-* suites, green.
• src/lib/db/migrations/177_* / migrationRunner.ts / schemaColumns.ts / src/lib/proxyLogger.ts: covered by the 4 journal tests (migration, reconciler, memory/SQLite/export, null, filters).
• src/sse/handlers/chatHelpers.ts (withUpstreamStatus, mergeAppliedProxySink, safeLogEvents) / chat.ts (call site, 0 net): covered by the 8 transport tests, including the local-429-no-fetch case.
• Untested by choice: relay/TLS/native-fallback/Bun return paths (single wrapper covers them by construction, grep-verified one install).

Reviewer Notes

• Contract: upstream_status is the status received; it can differ from the status served to the client after applyStatusRestatement (403 received, 429 served).
• Request capture wraps status capture with no dependency between them.
• A chat POST via the TLS layer whose first byte expires gives null (never replayable).
• A fetch left running in the background by an executor after its return no longer writes (dispatch token); a side fetch awaited before the return counts.
• Relay rows carry the relay's code, identifiable by proxy type.
• Cloud mode: null.
• proxyFetch.ts rebaselined +4 (single install-site plumbing: one import, one blank, sink getter, wrapper const) with note; 50 llm.txt copies regenerated via sync-llm-mirrors.
• Migration count 173 → 174.
• Expected merge conflict with feat(proxies): show how many egress IPs actually served a proxy pool #13581, in config/quality/file-size-baseline.json only: both PRs insert their _rebaseline_… note right after the opening {. Whichever lands second needs both keys and both caps kept (open-sse/utils/proxyFetch.ts 1275 here, ProxyRegistryManager.tsx 1477 there). I can update the branch if you'd rather not resolve it on merge.
• Follow-up: feat(proxies): stop re-serving a pool member the provider just refused #13595 (stacked on this PR and feat(proxies): stop re-serving a proxy that just failed #13578) uses the recorded upstream status to set aside a pool member that got a real provider 429, while a 429 generated locally never is.