feat(integrations): add OMP client support

[n3wr1ch]

Summary

• add OMP as a first-class file integration backed by ~/.omp/agent/models.yml
• export the complete routed opencodex catalog in OMP's provider schema, including non-GPT models and capability metadata
• expose OMP in the GUI dashboard, management API, CLI help, localized copy, and integration documentation

Dependency

Depends on #1085 and extends its Pi-compatible export contract. GitHub does not allow an upstream PR to target a fork-owned PR head, so this draft targets dev; the shared #1085 commits disappear from this diff when the parent lands. Keep this draft stacked until then, then rebase it onto current dev.

Security review

This adds a credential destination and requires explicit maintainer security review. No user or provider secret is serialized: OMP receives the existing non-secret opencodex-loopback placeholder, and integration writes remain restricted to loopback proxy binds. Upstream provider credentials stay in opencodex's own configuration.

Verification

• bun run typecheck
• bun run test — 9,053 pass, 8 skip, 0 fail
• bun run privacy:scan
• cd gui && bun test tests — 606 pass, 0 fail
• cd gui && bun run lint
• cd gui && bun run lint:i18n
• cd gui && bun run build
• cd docs-site && bun install --frozen-lockfile && bun run build
• focused client integration/export suites — 138 pass, 0 fail
• real OMP catalog load: omp models opencodex --json recognized routed GPT, Claude, and Grok models
• browser smoke test: #integrations/omp rendered the OMP state, config path, and restart guidance against the updated management API

Screenshot

The GUI exposes OMP as its own integration tab and reports the generated models.yml destination and restart semantics.

Checklist

• Scope stays focused and avoids unrelated cleanup; the additional visible commits belong to dependency fix(pi): keep loopback models visible #1085.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults; explicit maintainer security review is requested above.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit. This remains unchecked while the PR depends on fix(pi): keep loopback models visible #1085.

• I fixed all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2c9c9322-15db-4d9a-888c-5696af0b54bd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (1/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 1/4).

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

1/4 boxes ticked.

This PR stays in draft until every box above is ticked.