Route exec-server HTTP through configured proxy policy (#35023)

## Why

Delegated HTTP requests need to honor the same outbound proxy policy as the
Codex process that starts the exec server.

## What changed

- Pass the configured `HttpClientFactory` through local and remote exec-server
  startup and use route-aware client pools for delegated HTTP and local MCP
  requests.
- Preserve per-request timeouts and follow-or-stop redirect behavior while
  keeping request URLs and sensitive response headers out of diagnostics.

## Testing

- Cover configured system-proxy routing across the exec-server transport.
- Cover both redirect policies and verify that success and failure logs do not
  expose request or response secrets.

GitOrigin-RevId: 4af6aec1d265c4db62dfcb6e1fb076fb31736137

codex-rs/rmcp-client/src/perform_oauth_login.rs

@@ -11,6 +11,8 @@ use base64::Engine;
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use codex_exec_server::HttpClient;
 use codex_exec_server::ReqwestHttpClient;
+use codex_http_client::HttpClientFactory;
+use codex_http_client::OutboundProxyPolicy;
 use reqwest::Url;
 use rmcp::transport::AuthorizationManager;
 use rmcp::transport::AuthorizationSession;
@@ -160,7 +162,9 @@ async fn perform_oauth_login_with_browser_output(
     let http_context = OAuthHttpContext {
         http_headers,
         env_http_headers,
-        http_client: Arc::new(ReqwestHttpClient),
+        http_client: Arc::new(ReqwestHttpClient::new(HttpClientFactory::new(
+            OutboundProxyPolicy::ReqwestDefault,
+        ))),
     };
     OauthLoginFlow::new(
         server_name,
@@ -209,7 +213,9 @@ pub async fn perform_oauth_login_return_url(
         timeout_secs,
         callback_port,
         callback_url,
-        Arc::new(ReqwestHttpClient),
+        Arc::new(ReqwestHttpClient::new(HttpClientFactory::new(
+            OutboundProxyPolicy::ReqwestDefault,
+        ))),
     )
     .await
 }
@@ -715,6 +721,8 @@ mod tests {
     use axum::Router;
     use axum::routing::get;
     use codex_exec_server::ReqwestHttpClient;
+    use codex_http_client::HttpClientFactory;
+    use codex_http_client::OutboundProxyPolicy;
     use pretty_assertions::assert_eq;
     use reqwest::Url;
     use reqwest::header::HeaderMap;
@@ -774,7 +782,9 @@ mod tests {
         let oauth_state = start_authorization(
             &format!("{base_url}/mcp"),
             Arc::new(OAuthHttpClientAdapter::new(
-                Arc::new(ReqwestHttpClient),
+                Arc::new(ReqwestHttpClient::new(HttpClientFactory::new(
+                    OutboundProxyPolicy::ReqwestDefault,
+                ))),
                 HeaderMap::new(),
             )),
             &[],