refactor: dual-path AI provider (direct API + Codex VPS) (#125)

Claude/GPT calls go direct via API keys in repo secrets.
Codex VPS calls go through the CodexAuditBridge service.

This matches the reality that the VPS only runs Codex CLI;
API fallbacks are called directly from the workflow.

Co-authored-by: Claude <noreply@anthropic.com>

Author: Pigbibi