backend-client: add workspace attribution settings transport

[jayp-oai]

Summary

• add a typed authenticated GET settings/user call to codex-backend-client
• route correctly through /api/codex/settings/user or ChatGPT's /wham/settings/user
• reuse the existing auth provider so the active ChatGPT-Account-ID and FedRAMP routing follow the current CLI account
• default an omitted commit_attribution_enabled field to false for safe compatibility with pre-BIZG-546 servers
• request fresh settings with Cache-Control: no-store

Why

BIZG-549 requires Codex CLI sessions to consume the effective workspace attribution policy computed by BIZG-546. The CLI should not read /accounts/{id}/settings, infer eligibility from local plan claims, or add an enterprise policy to TOML. The existing backend client is the narrow shared transport that already owns Codex API versus /wham routing and authenticated workspace headers.

Scope and dependencies

This draft is an independently mergeable foundation directly on main; it is not stacked on BIZG-548 and contains no prompt-attribution logic.

BIZG-548 is not yet present on main, so the remaining CLI integration is deliberately not duplicated here. After BIZG-546 and BIZG-548 are available, the follow-up in this PR can fetch these settings from the current auth snapshot at thread bootstrap, treat timeout/fetch/decode failures as disabled without blocking startup, and pass only the resolved gate into the shared contributor. End-to-end enabled/disabled, personal/ineligible, offline, workspace-switch, app-server, and MCP-host coverage depends on that consumer seam.

Ticket: BIZG-549

Validation

• just fmt
• just test -p codex-backend-client — 19 passed
• just fix -p codex-backend-client
• structured autoreview against the uncommitted origin/main diff — clean, no accepted/actionable findings