fix(proxy): port post-dispatch failover to OpenAI chat completions

[rohith500]

Summary

ProxyOpenAIChatCompletion had no post-dispatch failover: neither baseline
retry (OSS outage → requested Anthropic model) nor subscription-credit
retry (OAuth 429/timeout or 401/403 → Weave/BYOK key). Both already work in
ProxyMessages. Live pre-fix: identical OSS-outage fixture returned raw
503 with anthropicCount=0 on OpenAI while Messages recovered via Anthropic.

Full root-cause and evidence: #771

Fix

Port both mechanisms into ProxyOpenAIChatCompletion, same eligibility and
pre-commit gates as Messages. Design choice: second full port (not a shared
helper) because emit/flush paths differ (OpenAI uses PrepareAnthropic +
SSE translator; Messages uses Anthropic-native SSE). Local
openaiAnthropicAttempt is reused by both retry sites on the OpenAI path
only — ProxyMessages is untouched.

1. Baseline failover when cost-routed OSS bindings fail retryably /
   model-not-found and the caller requested a known Anthropic catalog model.
2. Subscription-credit retry when an Anthropic+subscription turn fails
   with IsRetryable or anthropicOAuthCredentialRejected (401/
   authentication_error, 403/permission_error).

Out of scope (called out in #771)

• UsageBypass on the OpenAI path — still absent; separate issue. This PR
  only covers the reactive subscription-retry half of that composite case.
• failover_used / fallback_attempts telemetry accuracy when a cross-
  binding retry ran but the request still failed — same Messages semantics;
  left alone to avoid OpenAI-only asymmetry.

Tests

• TestProxyOpenAI_OSSOutageFailsOverToBaselineAnthropic (+ negatives:
  forced model, requested OSS, Anthropic excluded)
• TestProxyOpenAI_SubscriptionRetry_Live429FailsOverToDeployKey
• TestProxyOpenAI_SubscriptionRetry_OAuth401FailsOverToDeployKey
• TestProxyOpenAI_SubscriptionRetry_OAuth403FailsOverToDeployKey

Live verification (committed tip)

Check	Pre-fix (#771)	Post-fix
OSS outage baseline	fw=1, or=1, anth=0 → 503	fw=1, or=1, anth=1 model=claude-opus-4-8 → 200
Sub 429	dispatch[0..2] OAuth → client 429	dispatch[0..2] OAuth → dispatch[3] deploy key → 200
Sub 401/403	1× OAuth → client raw	OAuth reject → deploy key → 200

Test plan

• New tests fail on main, pass on this branch
• make check green
• go test ./internal/proxy/... -race clean except known TestFireTelemetryRecoversFromPanic flake
• ProxyMessages region unchanged (diff only in ProxyOpenAIChatCompletion)
• New comments kept ≤2 consecutive lines (comment-length review)

Fixes #771

Made with Cursor

[greptile-apps]

PR author is not in the allowed authors list.

[devin-ai-integration]

Thanks @rohith500 — conforms to the repo conventions, no rewrite needed. 👍 The baseline and subscription failover ports mirror the ProxyMessages predicates on proxy.Service, reuse the existing dispatchWithFallback/failoverInputs machinery with a shared openaiAnthropicAttempt closure, keep pre-commit prelude semantics intact, and use sentinel errors + slog correctly. The tests are non-tautological end-to-end guards (real httptest upstreams for the OSS-outage baseline path, forced-model non-substitution, exclusion, and OAuth 429/401/403 deploy-key retries). Great work!