fix(settings): filter Fetch Metadata headers from Responses proxy

[ewen-poch]

Problem

Codex validation for DeepSeek deepseek-v4-flash correctly targets the native Responses endpoint, but the loopback Node fetch adds sec-fetch-mode. The compatibility proxy forwarded that browser-controlled header to Electron net.fetch, which rejects it with net::ERR_INVALID_ARGUMENT before the request reaches DeepSeek.

Proposed change

• Strip sec-fetch-* Fetch Metadata headers when forwarding loopback requests upstream.
• Add a regression test that reproduces Electron's rejection at the external fetch seam and verifies the proxy completes the request after filtering.

Scope and non-goals

• No architecture, data model, data relationship, configuration, or UI changes.
• No change to DeepSeek model routing: deepseek-v4-flash continues to use /v1/responses under Codex.
• No dependency or public interface changes.

Acceptance criteria and validation

All checks below ran after the last material edit.

Behavior	Command	Result
Loopback Fetch Metadata headers no longer trigger the Electron boundary failure	npm test -- --run src/main/settings/native-responses-compatibility.test.ts -t "forwards loopback requests without browser-controlled Fetch Metadata headers"	Pass: 1 test
Native Responses compatibility and DeepSeek Codex routing remain valid	npm test -- --run src/main/settings/native-responses-compatibility.test.ts src/main/settings/service.test.ts -t "native Responses compatibility|probes DeepSeek flash through the native Responses route under Codex"	Pass: 9 tests
TypeScript contracts remain valid	npm run typecheck	Pass
Repository lint gate	npm run lint	Pass: 0 errors; 23 existing warnings
Full unit/integration suite	npm test	Pass: 9,073 tests; 140 skipped

Independent review completed with 0 Standards findings and 0 Spec findings.

Review focus

• Confirm filtering the sec-fetch-* family is appropriately scoped for Electron net.fetch.
• Confirm required upstream headers other than browser-controlled Fetch Metadata remain forwarded.

Uncovered risk

The suite does not use a live valid DeepSeek API key. It covers the local proxy behavior and Electron rejection contract without exercising a billed provider response.