feat(responses): add encrypted reasoning replay opt-in

[jackjinke]

Summary

• add a default-off connection toggle for encrypted OpenAI Responses reasoning replay
• apply the selected connection policy to Codex, first-party OpenAI, and OpenAI-compatible Responses upstreams, including combo targets
• preserve only self-contained reasoning.encrypted_content input items when enabled
• always remove stored item references and sanitize server-generated response item IDs
• validate and normalize the persisted setting
• place the replay toggle with connection-level controls, immediately above Disable cooldown for this connection
• omit opaque encrypted_content values from persisted structured payloads and captured SSE chunks while retaining compact diagnostic markers

Closes #9000

Tests

Changed test files:

• tests/unit/chatcore-translation-paths.test.ts
• tests/unit/strip-reasoning-blobs-agentic-context-1599.test.ts
• tests/unit/provider-specific-data-schema.test.ts
• tests/unit/request-defaults-store-session.test.ts
• tests/unit/request-log-payloads.test.ts
• tests/unit/ui/edit-connection-modal-free-models.test.tsx

Commands run after rebasing onto current release/v3.8.50:

• node --import tsx/esm --test tests/unit/strip-reasoning-blobs-agentic-context-1599.test.ts tests/unit/chatcore-translation-paths.test.ts tests/unit/provider-specific-data-schema.test.ts tests/unit/request-defaults-store-session.test.ts tests/unit/executor-codex.test.ts — 133 passed
• npm exec -- vitest run tests/unit/ui/edit-connection-modal-free-models.test.tsx — 12 passed
• node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit tests/unit/request-log-payloads.test.ts — 9 passed
• ./node_modules/.bin/eslint src/lib/logPayloads.ts src/lib/usage/callLogs/format.ts tests/unit/request-log-payloads.test.ts --suppressions-location config/quality/eslint-suppressions.json — passed
• npm run test:coverage — coverage thresholds passed: 84.35% statements, 84.35% lines, 88.23% functions, 78.64% branches. Unrelated existing suite failures kept command exit nonzero, including provider golden snapshot drift and service-supervisor port adoption.

Manual combo validation

Validated one session against a combo containing gpt-5.6-sol and kimi-k3:

1. Initial turns routed to gpt-5.6-sol; encrypted reasoning content was returned and preserved in client replay history.
2. Removed gpt-5.6-sol from the combo; the same session switched to kimi-k3 and continued successfully. OmniRoute omitted the Codex-only encrypted reasoning item from the non-Responses upstream request while the client retained it.
3. Restored gpt-5.6-sol; the same session switched back and continued successfully with the retained encrypted reasoning available again.

This confirms mixed-provider combo switching does not break the session and Codex encrypted reasoning survives a temporary hop through a non-Responses target for reuse when routing returns to Codex.

Context

Inspired by OpenAI's report that retained reasoning and compaction tripled ARC-AGI-3 scores while reducing output tokens: https://openai.com/index/how-two-settings-tripled-our-arc-agi-3-scores/

This PR intentionally adds only user-controlled passthrough for encrypted reasoning already present in request input. It adds no replay cache, stored-response lineage, or server-side compaction policy.

[jackjinke]

This PR was accidentally closed while cleaning up and recreating my fork. GitHub would not allow it to be reopened, so I recreated it as #9601 with the same implementation rebased onto the latest release/v3.8.50.