fix(app-server): thread history redaction for remote clients

[owenlin0]

Summary

Remote clients can still receive large thread/resume histories when prior turns include MCP tool call payloads or image-generation results. This adds a temporary response-only redaction path for the known remote client names.

Longer term we will move towards fully paginated APIs backed by SQLite.

Changes

• Redact MCP tool call payload-bearing fields in thread/resume responses for codex_chatgpt_android_remote and codex_chatgpt_ios_remote.
• Drop imageGeneration items from those thread/resume responses.
• Keep redaction out of persisted rollout files, thread/read, thread/turns/list, live notifications, and token usage replay.
• Cover the behavior with app-server helper tests and a v2 resume integration test that checks both remote clients plus a non-target control client.

Testing

• cargo test -p codex-app-server thread_resume_redaction
• cargo test -p codex-app-server thread_resume_redacts_payloads_for_chatgpt_remote_clients