feat(api-tab): show which key did what, and say what each endpoint accepts

The API tab described its own auth rules from memory and got them wrong:
the subtitle advertised `Authorization: Bearer` for every endpoint, which
/v1/responses and /v1/chat/completions reject. The rules now ship from the
server as an auth matrix and the page only names them, so the table cannot
drift from the code that enforces it. An empty or malformed matrix is a load
failure, never a rendered empty table.

Keys gained a detail pane with attributed usage, a rename editor, and a
delete that waits for its own request instead of navigating away from a
failure. `attributionSince` is a dataset-level fact: a key with zero requests
reads as zero, and a proxy with nothing attributable yet says so — those were
the same blank before. Malformed `usage` from either the network or the
session cache is now rejected rather than coerced to zeroes, which used to
assert "never used" about data we could not read.

The per-model test button became one chip per protocol, each posting the body
its own wire expects; a chat body sent to Responses proved nothing about
Responses. Each chip carries the one-time key in `x-opencodex-api-key` and is
disabled without one, because on a loopback bind an unauthenticated request
passes whether or not the key works.

Delete and rename hold the pane's navigation lock while in flight, so both are
bounded at 15s — a connection that never answers used to leave the rail, Back,
and Overview disabled until a reload.

api-keys-panels.tsx was 551 lines covering three subjects; the copy helpers and
the endpoint/auth surface now live in their own files.

Tests: 456 pass across 91 files, including a wire test that mounts the real
page and reads the requests that actually left `fetch`.

Author: lidge-jun

docs-site/src/content/docs/ja/reference/configuration.md

@@ -137,9 +137,21 @@ token を入れる必要があります。
 x-opencodex-api-key: your-secret-token
 ```
 
-`Authorization: Bearer …` ヘッダーも許可します。起動後はダッシュボードで生成した `apiKeys` を環境変数
-token の代わりに使えます。すべての候補は timing side channel を防ぐため定数時間
-（`timingSafeEqual`）で比較します。
+受け付けるヘッダーはエンドポイントごとに異なります。常に使えるのは `x-opencodex-api-key` です:
+
+| エンドポイント | `Authorization: Bearer` | `x-opencodex-api-key` | `x-api-key` |
+|---|---|---|---|
+| `/v1/responses` | 不可 | **必須** | 不可 |
+| `/v1/chat/completions` | 不可 | **必須** | 不可 |
+| `/v1/messages` | 可 | 可 | 可 |
+| `/v1/models` | 可 | 可 | 可 |
+
+Responses と Chat Completions が専用ヘッダーのみを受け付けるのは、その 2 経路の `Authorization` が
+Codex Direct パススルーのものである可能性があり、2 つの bearer ドメインを混同できないためです。
+ダッシュボードの API タブもこの表をサーバーから受け取って描画するため、コードとずれません。
+
+起動後はダッシュボードで生成した `apiKeys` を環境変数 token の代わりに使えます。すべての候補は
+timing side channel を防ぐため定数時間（`timingSafeEqual`）で比較します。
 
 :::caution[LAN 公開]
 `0.0.0.0` にバインドするとプロキシと設定されたすべてのプロバイダー認証情報がローカルネットワークにさらされます。

docs-site/src/content/docs/ko/reference/configuration.md

@@ -144,9 +144,21 @@ token을 넣어야 합니다.
 x-opencodex-api-key: your-secret-token
 ```
 
-`Authorization: Bearer …` 헤더도 허용합니다. 시작 후에는 대시보드에서 생성한 `apiKeys`를 환경 변수
-token 대신 쓸 수 있습니다. 모든 후보는 timing side channel을 막기 위해 상수 시간
-(`timingSafeEqual`)으로 비교합니다.
+받는 헤더는 엔드포인트마다 다릅니다. 항상 되는 건 `x-opencodex-api-key` 하나입니다:
+
+| 엔드포인트 | `Authorization: Bearer` | `x-opencodex-api-key` | `x-api-key` |
+|---|---|---|---|
+| `/v1/responses` | 안 됨 | **필수** | 안 됨 |
+| `/v1/chat/completions` | 안 됨 | **필수** | 안 됨 |
+| `/v1/messages` | 가능 | 가능 | 가능 |
+| `/v1/models` | 가능 | 가능 | 가능 |
+
+Responses와 Chat Completions가 전용 헤더만 받는 이유는, 그 두 경로의 `Authorization`이 Codex Direct
+패스스루의 것일 수 있어서입니다. 두 bearer 영역이 헷갈리면 안 됩니다. 대시보드 API 탭도 이 표를
+서버에서 받아 그리기 때문에 코드와 어긋날 수 없습니다.
+
+시작 후에는 대시보드에서 생성한 `apiKeys`를 환경 변수 token 대신 쓸 수 있습니다. 모든 후보는
+timing side channel을 막기 위해 상수 시간(`timingSafeEqual`)으로 비교합니다.
 
 :::caution[LAN 노출]
 `0.0.0.0`에 바인드하면 프록시와 설정된 모든 프로바이더 자격 증명이 로컬 네트워크에 노출됩니다.

docs-site/src/content/docs/reference/configuration.md

@@ -252,9 +252,22 @@ systemd, or Task Scheduler receives it. Clients must include the token in every
 x-opencodex-api-key: your-secret-token
 ```
 
-An `Authorization: Bearer …` header is also accepted. Dashboard-generated `apiKeys` may be used in
-place of the environment token after startup; all candidates are compared in constant time
-(`timingSafeEqual`) to prevent timing side-channels.
+Which headers work depends on the endpoint, so `x-opencodex-api-key` is the one that always does:
+
+| Endpoint | `Authorization: Bearer` | `x-opencodex-api-key` | `x-api-key` |
+|---|---|---|---|
+| `/v1/responses` | not accepted | **required** | not accepted |
+| `/v1/chat/completions` | not accepted | **required** | not accepted |
+| `/v1/messages` | accepted | accepted | accepted |
+| `/v1/models` | accepted | accepted | accepted |
+
+Responses and Chat Completions accept only the dedicated header because `Authorization` on those
+transports may belong to Codex Direct passthrough, and the two bearer domains must not be
+confusable. The API tab in the dashboard renders this same table from the server, so it cannot
+drift from the code.
+
+Dashboard-generated `apiKeys` may be used in place of the environment token after startup; all
+candidates are compared in constant time (`timingSafeEqual`) to prevent timing side-channels.
 
 :::caution[LAN exposure]
 Binding to `0.0.0.0` exposes your proxy — and all configured provider credentials — to the local

docs-site/src/content/docs/ru/reference/configuration.md

@@ -167,9 +167,22 @@ ocx start
 x-opencodex-api-key: your-secret-token
 ```
 
-Заголовок `Authorization: Bearer …` также принимается. Сгенерированные в дашборде `apiKeys`
-после запуска можно использовать вместо токена из окружения; все кандидаты сравниваются за
-константное время (`timingSafeEqual`) для защиты от атак по времени.
+Какие заголовки подходят, зависит от эндпоинта. Всегда работает только `x-opencodex-api-key`:
+
+| Эндпоинт | `Authorization: Bearer` | `x-opencodex-api-key` | `x-api-key` |
+|---|---|---|---|
+| `/v1/responses` | не принимается | **обязателен** | не принимается |
+| `/v1/chat/completions` | не принимается | **обязателен** | не принимается |
+| `/v1/messages` | принимается | принимается | принимается |
+| `/v1/models` | принимается | принимается | принимается |
+
+Responses и Chat Completions принимают только выделенный заголовок: `Authorization` на этих
+транспортах может принадлежать passthrough Codex Direct, и две области bearer нельзя путать.
+Вкладка API в дашборде рисует эту же таблицу по данным сервера, поэтому она не разойдётся с кодом.
+
+Сгенерированные в дашборде `apiKeys` после запуска можно использовать вместо токена из
+окружения; все кандидаты сравниваются за константное время (`timingSafeEqual`) для защиты от
+атак по времени.
 
 :::caution[Доступ по LAN]
 Привязка к `0.0.0.0` открывает ваш прокси — и все настроенные учётные данные провайдеров —

docs-site/src/content/docs/zh-cn/reference/configuration.md

@@ -136,8 +136,21 @@ ocx start
 x-opencodex-api-key: your-secret-token
 ```
 
-也可以使用 `Authorization: Bearer …` header。启动后，仪表盘生成的 `apiKeys` 可代替环境 token。
-所有候选值均用常量时间（`timingSafeEqual`）比较，避免 timing side-channel。
+接受哪些 header 取决于端点，始终可用的只有 `x-opencodex-api-key`：
+
+| 端点 | `Authorization: Bearer` | `x-opencodex-api-key` | `x-api-key` |
+|---|---|---|---|
+| `/v1/responses` | 不接受 | **必需** | 不接受 |
+| `/v1/chat/completions` | 不接受 | **必需** | 不接受 |
+| `/v1/messages` | 可用 | 可用 | 可用 |
+| `/v1/models` | 可用 | 可用 | 可用 |
+
+Responses 和 Chat Completions 只接受专用 header，因为这两条链路上的 `Authorization` 可能属于
+Codex Direct 透传，两个 bearer 域不能混淆。仪表盘的 API 标签页同样从服务端获取并渲染这张表，
+因此不会与代码脱节。
+
+启动后，仪表盘生成的 `apiKeys` 可代替环境 token。所有候选值均用常量时间（`timingSafeEqual`）
+比较，避免 timing side-channel。
 
 :::caution[LAN 暴露]
 绑定到 `0.0.0.0` 会把代理和所有已配置 provider credential 暴露到本地网络。只应在可信网络中

gui/src/api-access-models.ts

@@ -7,8 +7,11 @@ export interface ExternalModelRow {
   custom?: boolean;
 }
 
+/** The inbound wires a client can speak to this proxy. */
+export type GatewayInboundProtocol = "responses" | "chat" | "messages";
+
 /** Inbound gateway protocols — not inferred from provider type. */
-export function gatewayInboundProtocols(claudeCodeEnabled: boolean): string[] {
+export function gatewayInboundProtocols(claudeCodeEnabled: boolean): GatewayInboundProtocol[] {
   return claudeCodeEnabled
     ? ["responses", "chat", "messages"]
     : ["responses", "chat"];