Move shared Codex, Claude, and xAI provider options under upstream so they apply consistently to OAuth and API-key credentials. Migrate historical OAuth paths, preserve OAuth-only header scope, and expose the new upstream management API path.
- Add `ClientConfig` and `CodexClientConfig` structs to `SDKConfig` - Move `optimize-multi-agent-v2` and add `enable-apply-patch` under `client.codex`
Introduce the v8 management configuration tree with migration-aware reads and writes, grouped upstream API-key providers, and independent v8 operational routes. Preserve legacy configuration compatibility while ensuring successful v8 writes migrate layouts, redact JSON TURN secrets, and keep OAuth-only provider settings from affecting API-key credentials.
