feat: add /openai/v1 passthrough to bedrock-mantle

[xiehust]

Summary

• Adds new /openai/v1/* endpoints that accept OpenAI-native API requests (Chat Completions, Responses API + full CRUD, /models) and forward them to AWS bedrock-mantle, gated by ENABLE_OPENAI_PASSTHROUGH=False.
• Reuses the proxy's existing API key auth (now also accepts Authorization: Bearer), rate limits, budgets, and usage tracking. Usage is normalized into the existing DynamoDB schema with two new sparse columns (api_surface, reasoning_tokens).
• Independent of ENABLE_OPENAI_COMPAT — both flags can be enabled together. The new endpoints are pure raw-httpx passthrough (no Pydantic schemas for OpenAI types) for forward compatibility with new Mantle features.

Endpoints:

Method	Path
POST	/openai/v1/chat/completions (streaming + non-streaming)
POST	/openai/v1/responses (streaming + non-streaming)
GET / DELETE	/openai/v1/responses/{id}
POST	/openai/v1/responses/{id}/cancel
GET	/openai/v1/responses/{id}/input_items
GET	/openai/v1/models

Documentation: see docs/plans/2026-05-25-openai-passthrough-design.md for the design rationale and docs/architecture/features.md for the user-facing feature doc.

Test plan

• 127/127 tests pass (uv run pytest tests/unit tests/integration/test_openai_passthrough)
• Routes registered when ENABLE_OPENAI_PASSTHROUGH=True; not present when False (regression test included)
• Authorization: Bearer and x-api-key both accepted
• Streaming chat completions: usage extracted from data: {... "usage": ...} chunk when client sends stream_options: {"include_usage": true}
• Streaming responses: usage extracted from response.completed SSE event
• Upstream timeout during streaming yields structured data: {"error": ...}\n\n[DONE] instead of crashing the stream
• CRUD endpoints (GET/DELETE/cancel/input_items) are pure passthrough with no usage logging
• Upstream 4xx returned verbatim with no usage logged
• Bedrock guardrail headers (X-Amzn-Bedrock-*) forwarded to upstream
• Model mapping table consulted with passthrough fallback
• Lint (ruff) and type (mypy) clean on the new module

Manual verification recommended before deploy:

• End-to-end with real bedrock-mantle credentials (OPENAI_API_KEY, OPENAI_BASE_URL) using OpenAI Python SDK
• Multi-turn conversation chaining via previous_response_id
• Verify usage rows in DynamoDB include api_surface and reasoning_tokens columns

Follow-ups (out of scope)

• OTEL tracing on the new endpoints (deferred per design doc)
• Admin portal api_surface filter (deferred)
• Refactor router to inject DDB managers via FastAPI `Depends` instead of module-globals + `importlib.reload` in tests