feat: VS Code Copilot Chat proxy integration

[damnthonyy]

Description

Enables Copilot Chat in VS Code to route LLM requests through Headroom without TLS MITM — solving the CERTIFICATE_VERIFY_FAILED issue that blocked Windows/WSL users (see #962).

The patched VS Code Copilot Chat extension (damnthanyy/vscode) intercepts requests internally and rewrites the destination URL to headroom, forwarding the original LLM host via X-Original-Host. This PR adds the headroom-side support for that header.

VS Code Copilot Chat (patched fork)
  → POST http://localhost:8787/v1/chat/completions
      X-Original-Host: api.githubcopilot.com
      Authorization: Bearer <gh-token>

headroom (this PR)
  → reads X-Original-Host → upstream = https://api.githubcopilot.com
  → compresses context
  → forwards to https://api.githubcopilot.com/v1/chat/completions

User setup (3 commands after git clone):

# 1. Build the patched VSIX (Docker)
docker compose --profile plugin run --rm vscode-plugin-builder

# 2. Install in VS Code
code --install-extension ./plugin/copilot-proxy.vsix --force

# 3. Add to VS Code settings.json
# "github.copilot.chat.proxy.url": "http://localhost:8787/v1"
# "extensions.autoUpdate": false

Closes #962

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Performance improvement
• Code refactoring (no functional changes)

Changes Made

• headroom/providers/proxy_routes.py — reads the X-Original-Host request header to resolve the upstream LLM endpoint; x-headroom-base-url takes precedence when both are present.
• tests/test_provider_proxy_routes.py — two new assertions: X-Original-Host passthrough and x-headroom-base-url precedence over X-Original-Host.
• docker-compose.yml — adds OPENAI_TARGET_API_URL=https://api.githubcopilot.com and GITHUB_TOKEN env vars; adds vscode-plugin-builder service (profile: plugin) that clones the patched VS Code fork, builds the extension, and outputs copilot-proxy.vsix to ./plugin/.
• Dockerfile.vscode-plugin (new) — node:24-slim multi-step builder: clones the fork, installs deps, runs npx tsx .esbuild.mts + vsce package, copies the .vsix to the mounted output volume.
• .gitignore — adds plugin/ to keep the built .vsix out of version control.

Testing

• Unit tests pass (pytest)
• Linting passes (ruff check .)
• Type checking passes (mypy headroom) — not run (no type annotations changed)
• New tests added for new functionality
• Manual testing performed (end-to-end on macOS — see below)

Test Output

$ pytest tests/test_provider_proxy_routes.py -v

tests/test_provider_proxy_routes.py::test_x_original_host_passthrough PASSED
tests/test_provider_proxy_routes.py::test_x_headroom_base_url_takes_precedence PASSED

========== 2 passed in 0.31s ==========

Real Behavior Proof

• Environment: macOS (arm64, M2); VS Code 1.101.0; patched Copilot Chat v0.53.2 (built from damnthonyy/vscode); Headroom running via docker compose up; model gpt-4o via api.githubcopilot.com (GitHub Copilot subscription).
• Exact command / steps:
  1. docker compose up -d (starts headroom + qdrant + neo4j)
  2. docker compose --profile plugin run --rm vscode-plugin-builder → produces ./plugin/copilot-proxy.vsix
  3. code --install-extension ./plugin/copilot-proxy.vsix --force
  4. Added "github.copilot.chat.proxy.url": "http://localhost:8787/v1" to VS Code settings.json
  5. Opened Copilot Chat, asked a question
• Observed result: headroom-proxy-1 logs showed the request arriving with correct X-Original-Host: api.githubcopilot.com header; headroom resolved the upstream, compressed context, and forwarded to GitHub Copilot API. Response appeared normally in VS Code Copilot Chat.
• Not tested: Windows native (only macOS validated); automated Docker CI build for VSIX (runs on demand only).

Review Readiness

• I have performed a self-review
• This PR is ready for human review

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have updated the CHANGELOG.md if applicable — pre-existing gap, no CHANGELOG in this repo

Additional Notes

• The VS Code extension patch lives in damnthonyy/vscode and is distributed as a pre-built VSIX via GitHub Releases (no need to build from source for end users once a release is published).
• x-headroom-base-url takes precedence over X-Original-Host so existing integrations that already set x-headroom-base-url are unaffected.
• The plugin Docker Compose profile is opt-in; normal docker compose up is unchanged.

[github-actions]

PR governance

This PR does not yet satisfy the required template fields:

• Fill in Real Behavior Proof → Environment.
• Fill in Real Behavior Proof → Exact command / steps.
• Fill in Real Behavior Proof → Observed result.
• Fill in Real Behavior Proof → Not tested.

Please update the PR body, or move the PR back to draft while it is still in progress.