feat: add policy-driven grant routing

[steipete]

Summary

• add manifest-declared response-header and on-demand quota collectors for OpenAI and Anthropic
• add policy-controlled priority, round-robin, least-used, most-remaining, weighted, identity-sticky, and session-sticky grant selection
• add atomic selection counters, explicit eligibility and stale-state gates, bounded same-provider failover, OAuth weight propagation, and fail-closed pool behavior
• expose grant routing, weight, quota windows, selection statistics, and quota refresh in the admin console; document the policy and provider-manifest contracts

Validation

• pnpm check (62 worker, 26 admin, 43 script tests)
• pnpm build
• pnpm worker:e2e
• source-blind behavior contract: all 9 clauses passed, covering round-robin, least-used, stickiness, eligibility, stale denial, disabled failover, quota probes, legacy defaults, and invalid policy rejection
• local browser demo: JSON eligibility refs round-trip without delimiter loss; Upstream renders weight, counters, quota windows, refresh-token, and refresh-quota controls
• structured review clean after fixes

Closes #59

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat: add policy-driven grant routing This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 738dc38470

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor fail-closed policies during Access selection

When a Cloudflare Access identity has multiple matching policies, this checks only .selected and skips a higher-priority policy whose routing intentionally returns no grant while hasConfiguredGrant is true, e.g. eligibleGrants: { openai: [] } or staleState: "deny" with no fresh state. The request can then run under a lower-priority policy with an available grant, bypassing the new fail-closed/allowlist contract for browser Access flows; proxy-key flows still enforce it because they use the credential's single policy directly.

Useful? React with 👍 / 👎.