fix: handle CORS preflight and interrupted WorkBuddy tools

[caigee-cmd]

Summary

• Fix 跨域情况下，OPTION类型的请求会被401阻止 #145 by answering CORS preflight OPTIONS requests on OpenAI-compatible endpoints without weakening API-key authentication on actual requests.
• Fix workbuddy接入模型，在模型回复期间中断后再继续沟通时出错 #144 by preserving complete WorkBuddy tool rounds and removing only incomplete tool rounds after interrupted requests.
• Add request-chain, CORS, classification, and tool-history regression tests.

Test plan

• go test ./...
• go vet ./...
• go test -race ./internal/providers/workbuddy ./internal/api
• cd worker && npm test
• cd frontend && npm run build && npm run lint
• Live US1 validation with a temporary container and real WorkBuddy account: single-turn, complete multi-turn tool call, and interrupted follow-up all returned HTTP 200.
• No tokens, auth blobs, raw captures, or host details in the diff.

Fixes #144
Fixes #145