feat(labs): unlock native Codex vision for lab OCR

Image input rides the ChatGPT-OAuth codex/responses endpoint via the
input_image content block (protocol spec 2b) — no vision API key. The
codex client folds params.images into input_image blocks alongside the
input_text; text-only calls keep the prior byte-identical wire. The
vision gate now resolves codex capability against the working slug
(GPT-5.x / gpt-4o-class multimodal) instead of a blanket false, with the
OCR capability resolver feeding the codex slug rather than the user's
aiModel. A non-multimodal slug or an image-block rejection degrades to a
clean extract failure / local-OCR text mode.

src/lib/labs/ocr-capability.ts

@@ -11,6 +11,7 @@
  */
 import type { ProviderChainResolved } from "@/lib/ai/provider-runner";
 import { resolveProvider, resolveProviderChain } from "@/lib/ai/provider";
+import { resolveCodexVisionSlug } from "@/lib/ai/codex-client";
 import { prisma } from "@/lib/db";
 import {
   supportsPdfForProvider,
@@ -31,6 +32,10 @@ function modelForEntry(
   providerType: ProviderChainResolved["providerType"],
   ctx: ModelContext,
 ): string | null {
+  // Codex resolves its working slug at request time from the OAuth slug
+  // fallback chain — NOT from the user's `aiModel`. Use the cached/chain-head
+  // slug so the codex vision gate tests the model that actually runs.
+  if (providerType === "codex") return resolveCodexVisionSlug();
   return providerType === "admin-openai" ? ctx.adminModel : ctx.userModel;
 }