fix: improve upstream request compatibility and body size configuration

[kiroo92]

Summary

This PR improves upstream request compatibility and request validation in three areas:

1. Fix tool schema translation when array parameters omit items.
2. Make the max request body size configurable through environment variables.
3. Fix /v1/responses/compact request shaping so it does not send fields rejected by the
   compact upstream endpoint.

Changes

1. Fix missing items in tool schemas

Files:

• proxy/translator.go
• proxy/anthropic.go
• proxy/translator_test.go

What changed:

• Added sanitizeSchemaForUpstream, which keeps the existing unsupported-schema-key cleanup and
  also recursively injects an empty items schema for arrays that declare "type": "array" but
  omit "items".
• Applied this sanitization to:
  • OpenAI tool translation
  • Responses API tool normalization
  • Anthropic tool conversion

Why:

• Some upstream validations reject array schemas that do not explicitly declare items.
• Before this change, tool definitions with array parameters could be forwarded in a shape that
  upstream refused.

Effect:

• Tool schemas are now normalized into a format the upstream validator accepts.
• This reduces request failures caused by incomplete JSON Schema emitted by clients or MCP
  tools.

Tests:

• Added coverage to verify missing items is injected in both normal request translation and
  Responses-body preparation.

2. Make max request body size configurable

Files:

• config/config.go
• config/config_test.go
• main.go
• security/validator.go

What changed:

• Added MaxRequestBodySize to runtime config.
• Added env var support: CODEX_MAX_REQUEST_BODY_SIZE_MB.
• Set the default max request body size to 32 MB.
• Wired the configured value into security.RequestSizeLimiter.
• Replaced the old fixed request-size limit with a configurable runtime variable while retaining
  a named default constant.

Why:

• The previous request body size limit was hard-coded, which made large tool or Responses
  payloads fail unnecessarily in deployments that need a higher ceiling.
• Operators now have a simple configuration switch instead of needing code changes.

Effect:

• Default behavior becomes more practical for larger payloads.
• Deployments can tune request size limits without patching the service.

Tests:

• Added config tests for default value loading and env override behavior.

3. Fix /v1/responses/compact request shaping

Files:

• proxy/handler.go
• proxy/translator.go
• proxy/translator_test.go

What changed:

• ResponsesCompact now uses PrepareCompactResponsesBody instead of the generic
  PrepareResponsesBody.
• The compact-specific preparation still reuses the shared input normalization logic, but
  removes auto-injected fields that the compact upstream endpoint does not accept:
  • include
  • store
  • stream

Why:

• The generic Responses preparation injects defaults that are valid for the standard Responses
  endpoint but not for /responses/compact.
• Sending those fields upstream can cause compact requests to be rejected or shaped incorrectly.

Effect:

• /v1/responses/compact keeps the normalized input format it needs, while no longer sending
  unsupported fields.
• Standard Responses requests still retain their existing default behavior.

Tests:

• Added tests to verify:
  • standard Responses requests still get the expected injected defaults
  • compact requests remove unsupported fields
  • compact input normalization is preserved
  • client-supplied include is also stripped for compact requests

Diff Scope

Compared with james-6-23/main, this PR changes 8 files with 248 insertions and 11 deletions.

Validation

Added/updated unit tests in:

• config/config_test.go
• proxy/translator_test.go