feat: use OpenCodex native web search

[yujimtb]

Summary

• recognize the current opencodex model independently of its pi wire API
• send web_search requests to OpenCodex /v1/alpha/search with the current model id and normalize its existing result envelope
• keep OpenCodex admission auth separate from upstream bearer auth, omit the public opencodex-loopback placeholder, and preserve pi session-affinity headers
• bound responses to 16 MiB and keep only HTTP(S) source URLs

This lets OpenCodex choose native search from its resolved provider route and returns that result to the same pi model/tool loop. It does not select a separate search model.

Depends on lidge-jun/opencodex#5850 for Devin routes; existing OpenCodex relay/sidecar behavior remains usable for other routes.

Tests

• npm test
• npx tsc --noEmit --pretty false
• git diff --check
• live E2E against OpenCodex PR #5850 for devin/claude-sonnet-5, devin/grok-4-7, and devin/swe-2 (five normalized native sources each)

No dependency or lockfile changes.