fix(proxy): preserve required egress for no-auth account proxy references

[xiaoyaner0201]

Summary

Preserve required proxy intent for no-auth account references, including after a proxy is force-deleted. This closes the reported OpenCode by-id account-proxy path without changing deliberately unconfigured/inline proxy behavior.

Fixes #15007.

Behavior

• Include accountProxies[].proxyId references in getProxyWhereUsed, counting references across accounts/connections alongside ordinary assignments.
• Default DELETE returns the existing 409 proxy_in_use response when account references remain. New diagnostics expose connection/provider/count only, not fingerprints, API keys, proxy credentials or raw provider metadata.
• A force delete (force=1 in the HTTP API) deletes the registry entry but retains the account's unresolved required binding. Clearing that reference would silently authorize direct traffic. An explicit account edit/reassignment/unbind is the separate way to change that intent.
• Missing, unreadable, malformed or inactive/error/disabled/dead/down by-id entries resolve as unavailable, not as unconfigured direct accounts.
• OpenCode excludes those accounts from its request-local list; if all are blocked it returns sanitized 503 proxy_unavailable before any upstream fetch. Unconfigured accounts remain direct and mixed lists retain healthy members.
• Extract the guard into a small used helper to keep the frozen executor file within its existing size cap. No baseline increase.

No new policy framework, migration, dependency, automatic reassignment or connection deletion/disable.

Verification

Base: active release/v3.8.52 at 666ea59b4c5980062c4012ee9228135ee4dd8989.

• Regression-first assertion failures on original behavior: account-reference counts/default deletion, missing/inactive proxy resolution, and all-blocked dispatch. Setup/import stalls were not counted as RED.
• Parent latest-base focused and related proxy suite: 47/47 pass.
• Parent historical OpenCode auth-hydration/request-account suites: 7/7 pass (7993-noauth-proxy-routing.test.ts, opencode-accounts-per-request.test.ts).
• Parent request-path probe uses a temporary DB, real create/delete handlers, real getProviderCredentials hydration and real OpenCode executor with a mocked upstream: default delete 409; forced delete 200; next request 503 with zero fetches; explicit unbind then returns 200 with one fetch. No live provider credentials/request used.
• Marker-removal sabotage in an isolated source copy causes the expected three assertion failures.
• Core, API and Open-SSE typecheck gates pass.
• Changed-file ESLint/Prettier, DB/migration rules, exact-base file-size, complexity/cognitive, dead-code and TS7 gates pass. The executor size violation found during parent verification was fixed by extraction, not hidden.
• Independent fresh-context review of the final runtime/test tree returned PASS with no blocker.

Existing base failures and limits

• typecheck:noimplicit:core: identical autoStrategy.ts:519 TS7006 on candidate and exact base.
• Strict mutation-registration gate: the same 24 unrelated missing references on both trees. The new executor regression is registered.
• No full host unit-suite, release build or CI-green claim. Full host tests include service-stop cases and were intentionally excluded; live CI results are separate.

Tests

• tests/unit/noauth-proxy-resolution.test.ts
• tests/unit/proxy-account-references-15007.test.ts
• tests/unit/opencode-required-proxy-15007.test.ts

[xiaoyaner0201]

CI documentation-gate attribution on the current head and exact release/v3.8.52 base 666ea59b4c5980062c4012ee9228135ee4dd8989:

npm run check:docs-counts exits 1 on both, with the same two strict findings: README.md still says OmniRoute v3.8.51, and llm.txt still says Current version: 3.8.51, while package.json is 3.8.52. I ran the identical command on this candidate and a pristine exact-base checkout and compared the diagnostic lists. Neither document nor the version bump is changed by this PR.

This is the new-cycle base's documentation drift, not a candidate-owned regression. I have not edited instruction surfaces or loosened the gate to make this branch green. Other CI jobs are tracked separately; this is not a full CI-green claim.

[maxmad64bis]

Thanks for picking this up so quickly — the fix matches the issue on all three points: account references counted in the 409 path (with connection/provider/count diagnostics, no secrets), force=1 keeping the binding instead of silently authorizing direct traffic, and unknown/inactive entries failing closed with a sanitized 503 rather than falling back to direct. Keeping deliberately unconfigured accounts direct is the right call, and the executor extraction instead of a baseline bump is appreciated.

I ran the comparison myself so you don't have to take my word for it: normalized ✖ lists from this PR vs #15086 (same release/v3.8.52 base) share almost everything — apart from the one regression noted below, the remaining delta is base-red noise (a flaky failure that passes on this side).

One real regression from this PR, in tests/unit/db-proxies-crud.test.ts ("assignProxyToScope normalizes key scope…"): the test asserts the old 409 message /Remove assignments first or use force=true/, but the PR changes it to "Remove assignments or account references first, or use force=true". The new message is the better one — the test just needs updating to match. Worth a one-line fix on your side whenever convenient; the owner will decide in any case.

Thanks again for the request-path probe with zero-fetch 503 — that's exactly the evidence this needed.

[diegosouzapw]

Thanks @xiaoyaner0201 — merged into release/v3.8.52; it ships in the next release.