[Epic]: First-class agent clients — Anthropic and OpenAI-protocol CLIs against our gateway

### Summary

Claude Code, Codex/ChatGPT and any Anthropic-protocol consumer should authenticate through Keycloak and get a **correct, complete protocol response** from `api.ai.camer.digital`.

### Intent

Today the auth story is unticketed per client, the Anthropic-callable model set is unknown, and a confirmed streaming defect breaks client-side context accounting on the exact path real clients use. Grouping the auth work with the protocol-correctness work means a "Claude Code works" claim covers the whole path, not just the token.

### Children

- **#679** — Codex / ChatGPT custom-model-provider OAuth2 against our gateway
- **#680** — Claude Code OAuth2 against our gateway
- **#536** — which models are actually callable via the Anthropic endpoint
- **#1072** — `message_start.usage.input_tokens = 0`; the real prompt size arrives late in `message_delta`, so a client reading the documented field gets zero every turn

### Acceptance Criteria

1. Each supported client completes an OAuth2 flow and a chat completion against `api.ai.camer.digital`, evidenced by the gateway access log.
2. The Anthropic-callable model set is produced by a **committed script** that probes the catalogue, not by a hand-written list.
3. `message_start` carries the real `input_tokens`, verified against the Anthropic streaming contract with a captured SSE transcript.

### Out of Scope

- LibreChat and the in-cluster consumers — different auth plane (ADR-0021 internal).
- Model catalogue content itself (`ai-helm-values`).

### Technical Context

⚠️ **#679/#680's ACs are defined by vendor documentation pages** that change silently and cannot be version-pinned. Quote the relevant excerpt into the ticket with the date read, and keep the AC behavioural — a vendor contract change then becomes a new ticket rather than a silently broken AC.

⚠️ **#1072's repro says the test model is "priced at 0, so this costs nothing".** That zero is an explicit **temporary** deviation dated 2026-08-24, annotated in `models.yaml` to be restored to the nominal price (ADR-0128). The defect is protocol-level and model-independent — reproduce on any model.

### AI Usage Declaration

Grouping identified and drafted by Claude Opus 5 during the 2026-09-01 triage sweep. AI output is not truth; the owner verifies.

Read child issues #679, #680, #536, and #1072 first, then inspect models.yaml and the gateway access-log and streaming-response paths they reference. Done means supported clients complete OAuth2 and chat requests, a committed catalogue-probing script produces the Anthropic-callable model set, and a captured SSE transcript verifies real input_tokens in message_start.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.