feat(console): route migrated BYOK through provider connections

[vimtor]

Summary

• Move generation proxying out of global middleware and into the shared inference handler after model extraction, before legacy model/authentication/rate-limit/billing checks.
• Use a routing-only key/workspace/provider lookup to send BYOK to /inference/custom/conn_<workspace suffix>_<provider>/...; other migrated requests retain managed destinations.
• Forward the unchanged Zen credential, use native model IDs for BYOK, and reuse existing body streaming. Do not forward provider credentials or fall back to paid managed inference after BYOK errors.
• Keep Go excluded. Give GET /zen/v1/models its own route-level proxy to /inference/v1/models, forwarding only Authorization and client IP headers.
• Preserve query strings, streaming, manual redirects, and sanitized routing failures. No request-body helper, APIEvent type, or special missing-model response changes remain.

Validation

• Console app typecheck passed; pre-push workspace typecheck passed all 30 tasks.
• Formatting and diff checks passed; targeted lint reported no errors, with existing handler warnings only.
• No local tests run; no deployment or live request verification.

Rollout limits

• Requires corresponding imported connections in new Console; do not enable BYOK cutover before they exist.
• Destination model mapping, policies, budgets, and OpenAI Chat/Responses compatibility still require end-to-end verification.
• Missing-model requests retain existing legacy validation rather than introducing a new error response.

Companion PR

Provider import: https://github.com/anomalyco/opencode-console/pull/2014