fix(codex-bridge): close the gaps an independent review found

- One decision per real turn: a turn starts with a user message after the
  previous final answer; tool steps, messages typed mid-turn, a lone "."
  and compaction keep the combo. Works without prompt_cache_key too.
- The virtual Otomatik name never reaches the gateway (stage off or error
  -> last choice or targets.zor); prefilter.target may not be it.
- finishCheck: at most once per turn; a broken, empty or refused retry
  delivers the already approved first answer.
- Layer window filter: only trusted windows, never the last layer.
- Correction channel only on always-pass targets while checks are on;
  Sesli-Hizli-Zeki stays always-pass by default; a >256 KB SSE frame
  passes unfiltered instead of breaking the stream.
- Turn-start questions wait in the local queue no longer than their
  timeout; decision-turn memory under a lock with refreshed order.
- Dify fetch refuses redirects (the app key never moves host); the
  rules file write retries a Windows sharing violation.
- An unreadable settings file no longer breaks every request.
- TypeScript accepts only https:// URLs the bridge accepts;
  finishCheck.timeoutSeconds (unused) removed.

Tests: 310 bridge tests, 36 electron tests; side-bridge live run for the
turn, prefilter (incl. decision timeout) and finish-check paths.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/desktop/assets/codex-bridge/karar_politikasi.py

@@ -13,11 +13,21 @@ jev_settings.POLICY_KEYS, each holding the same fields as the local settings sec
 import copy
 import json
 import time
+import urllib.error
 import urllib.request
 
 import jev_settings
 
 UA = "AITURK-IDE-codex-bridge/karar-politikasi"
+
+
+class _YonlendirmeYok(urllib.request.HTTPRedirectHandler):
+    """A redirect would carry the Authorization header to another host; it is an error instead."""
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise urllib.error.HTTPError(req.full_url, code, f"redirect refused: {newurl}", headers, fp)
+
+
+_ACICI = urllib.request.build_opener(_YonlendirmeYok)
 MAX_BYTES = 64 * 1024
 _son = {"zaman": 0.0}
 
@@ -43,7 +53,7 @@ def ayikla(cikti, yerel):
     return overrides
 
 
-def cek(settings, key, urlopen=urllib.request.urlopen):
+def cek(settings, key, urlopen=_ACICI.open):
     """One fetch. Returns {"ok": bool, "overrides": {...}, "error": str}; never raises."""
     if not key:
         return {"ok": False, "error": "Dify key not configured"}
@@ -70,7 +80,7 @@ def zamani_mi(settings, simdi=None):
     return settings['policy']['source'] == 'dify' and simdi - _son["zaman"] >= settings['policy']['refreshMinutes'] * 60
 
 
-def yenile(log=lambda _m: None, urlopen=urllib.request.urlopen, zorla=False):
+def yenile(log=lambda _m: None, urlopen=_ACICI.open, zorla=False):
     """Fetch when due; store the outcome. Local settings are read without the Dify overlay."""
     try:
         yerel, _ = _yerel_ayar()