Penalize eventless HTTP bridge accounts

[Komzpa]

Summary

Fixes an HTTP bridge recovery gap where a response.create send that never
receives response.created retires the stale bridge session but leaves the
selected account fully healthy.

That made later requests eligible to select the same eventless account again,
turning a single missing-created timeout into repeated
upstream_request_timeout failures. The request itself is still failed closed
without replaying or moving it to another account, but the selected account now
records the normal transient health failure so subsequent selection can avoid
the unhealthy route.

Changes

• Record a transient account-health penalty when the HTTP bridge owner-side
  missing-response.created deadline expires.
• Keep the existing fail-closed behavior: no transparent replay and no
  submission of the timed-out request on another account.
• Update the active OpenSpec change so the spec matches the health-accounted
  recovery behavior.
• Extend HTTP bridge regression coverage to verify the penalty reaches
  _handle_stream_error for a real Account.

Tests

• uv run pytest -q tests/unit/test_proxy_http_bridge.py
• uv run ruff check app/modules/proxy/_service/http_bridge/upstream_events.py tests/unit/test_proxy_http_bridge.py
• git diff --check
• openspec validate recover-codex-desktop-idle-bridge --strict

Full openspec validate --specs still reports existing normative-keyword
issues in api-keys and conversations-api, outside this change.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.