fix(providers): route chatgpt-session through the shared browser-session credential lifecycle

Both /api/providers routes gated the raw-cookie -> verified-storage-state
finalize step on a hardcoded chatgpt-web-codex check, so chatgpt-session
connections never had their pasted cookie replaced, never released the
temporary validation directory, and leaked validationId into persisted
providerSpecificData. Introduce usesChatGptBrowserSessionCredentials() as
the single source of truth for both provider ids and use it in place of
the hardcoded equality checks. Also replace a brittle source-regex test
with one that proves the validation dispatch actually resolves.

src/shared/constants/chatgptWebCodex.ts

@@ -10,3 +10,21 @@ export function isChatGptWebCodexModel(model: unknown): boolean {
 // persisted account session is valid. Keep runtime turns aligned with the headed browser
 // used to verify that same storage state.
 export const CHATGPT_WEB_CODEX_RUNTIME_HEADED = true;
+
+// Both "chatgpt-web-codex" and "chatgpt-session" store a verified Playwright storage
+// state produced from a pasted ChatGPT cookie header — the browser-session credential
+// lifecycle (decode -> ensure storage state -> inspect -> finalize) is shared between
+// them. The finalize step is what discards the raw pasted cookie in favor of the
+// verified storage state, so any dashboard route that gates on that lifecycle must
+// recognize both provider ids, not just the codex one.
+export const CHATGPT_BROWSER_SESSION_PROVIDER_IDS = [
+  CHATGPT_WEB_CODEX_PROVIDER_ID,
+  "chatgpt-session",
+] as const;
+
+export function usesChatGptBrowserSessionCredentials(provider: unknown): boolean {
+  return (
+    typeof provider === "string" &&
+    (CHATGPT_BROWSER_SESSION_PROVIDER_IDS as readonly string[]).includes(provider)
+  );
+}