refactor: dual-path AI provider (direct API + Codex VPS)

Claude/GPT calls go direct via API keys in repo secrets.
Codex VPS calls go through the CodexAuditBridge service.

This matches the reality that the VPS only runs Codex CLI;
API fallbacks are called directly from the workflow.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Pigbibi