auth: make STRIX_LLM=openai/subscription the single switch

Replace the separate STRIX_AUTH_MODE flag with a sentinel model value:
STRIX_LLM=openai/subscription selects the authenticated ChatGPT subscription,
and any other value is a normal API-key model. The env vars that already run
Strix are now the single source of truth — no second mode to keep in sync.

Encapsulate the behavior instead of branching everywhere:
- StrixProvider.get_model routes the sentinel to a _CodexResponsesModel backed
  by a cached OAuth client (no global default-client mutation, no per-call
  client churn).
- _CodexResponsesModel self-enforces the backend's requirements — streaming,
  store=false, encrypted reasoning, and the configured reasoning effort — so the
  runner, warm-up, and make_model_settings no longer special-case subscription.

Remove now-unneeded machinery: STRIX_AUTH_MODE/AuthMode, the
"incompatible model" warning, the non-OpenAI model coercion, the
make_model_settings codex flag, and the global set_default_openai_client wiring.
run.json still records a derived auth_mode so the viewer/telemetry/cost display
are unchanged. Switching modes is now just editing STRIX_LLM.

Sentinel-only (no per-model override): a subscription run uses gpt-5.4.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_codex_streaming.py

@@ -63,6 +63,9 @@ def _response_payload() -> dict[str, Any]:
     }
 
 
+_CAPTURED: dict[str, Any] = {}
+
+
 class _Handler(BaseHTTPRequestHandler):
     def log_message(self, *args: Any) -> None:
         pass
@@ -70,6 +73,8 @@ class _Handler(BaseHTTPRequestHandler):
     def do_POST(self) -> None:
         length = int(self.headers.get("Content-Length", 0))
         body = json.loads(self.rfile.read(length) or b"{}")
+        _CAPTURED.clear()
+        _CAPTURED.update(body)
         if not body.get("stream"):
             payload = json.dumps({"detail": "Stream must be set to true"}).encode()
             self.send_response(400)
@@ -136,3 +141,21 @@ async def test_codex_model_streams_and_aggregates(backend_url: str) -> None:
     response = await model.get_response(**_call_kwargs())
     assert response.output[0].content[0].text == "OK"
     assert response.usage.total_tokens == 2
+
+
+@pytest.mark.asyncio
+async def test_codex_model_self_enforces_backend_requirements(backend_url: str) -> None:
+    # The caller passes ordinary settings; the model must impose the backend's
+    # requirements (stream, store=false, encrypted reasoning) and the configured
+    # reasoning effort itself.
+    model = _CodexResponsesModel(
+        model="gpt-5.4", openai_client=_client(backend_url), reasoning_effort="high"
+    )
+    kwargs = _call_kwargs()
+    kwargs["model_settings"] = ModelSettings()  # nothing special from the caller
+    await model.get_response(**kwargs)
+
+    assert _CAPTURED["stream"] is True
+    assert _CAPTURED["store"] is False
+    assert _CAPTURED["include"] == ["reasoning.encrypted_content"]
+    assert _CAPTURED["reasoning"] == {"effort": "high"}