PR 1006 · Codex pool refactor + pool-aware create_image

Closes #1001 and #1008. Captures: staging gateway on claw, master tenant, light theme, openai-codex provider configured as a 2-member round_robin pool with openai-codex-2 as a member.

What changed

Chain entries pointing at a Codex OAuth pool now route through the pool's own strategy with internal failover. The outer chain only advances after the pool is fully exhausted.

Why it matters

Before: users could accidentally select a pool member in the chain and bypass pool semantics. Now: the dropdown hides pool members and tags owners with an inline Pool chip — mirrors the Create Agent dropdown.

Review cue

The inline Pool chip next to openai-codex — and the absence of openai-codex-2 from the list — proves the UX unification. Backend failover is proven by 5 integration scenarios in create_image_pool_chain_test.go.

1. Pool-filtered Provider dropdown

Red callout marks the openai-codex option tagged with an inline Pool chip. openai-codex-2 (a pool member) is no longer listed — pool routing is reached only by picking the owner, matching the existing Create Agent dropdown pattern.

Implemented Create Image — Provider Chain dialog, Provider dropdown open

Pool-filtered dropdown with inline Pool chip on owner

2. Backend validation

Full test matrix executed on the PR branch at the current HEAD.

go build ./...                           — ok (PG)
go build -tags sqliteonly ./...          — ok (Desktop)
go vet ./...                             — no issues
go test ./internal/tools/... ./internal/providers/...   — 1599 passed
Integration: 5 pool-chain scenarios × 5 runs under -race — 25/25 deterministic
pnpm --dir ui/web tsc --noEmit           — no errors