fix: preserve upstream user agent

[iBobbyTS]

Summary

• Preserve the client User-Agent header when forwarding gateway requests upstream.
• Centralize the small upstream-header whitelist in gateway.headers so proxy and passthrough endpoints use the same behavior.
• Apply the same header forwarding to /v1/embeddings passthrough requests.

Context

The gateway already had an extra_headers path through the proxy and transport layers, but the application handlers only populated x-request-id and OpenResponses-Version. As a result, upstream providers saw the transport/client default user agent instead of the SDK or agent user agent from the incoming request.

This keeps the forwarding explicit rather than proxying arbitrary request headers. The whitelist remains limited to x-request-id, User-Agent, and OpenResponses-Version.

Test plan

• /Users/ibobby/miniconda3/envs/llm-rosetta/bin/python -m pytest tests/gateway/test_app_headers.py tests/gateway/test_embeddings.py -q — 5 passed
• PATH=/Users/ibobby/miniconda3/envs/llm-rosetta/bin:$PATH make lint
• PATH=/Users/ibobby/miniconda3/envs/llm-rosetta/bin:$PATH make test — currently blocked in this local Python 3.14 environment by existing tests/gateway/test_auth.py failures using asyncio.get_event_loop() with no current event loop. This was reproduced on the fork point (origin/master) as well.

AI was used to assist with implementation and validation; I reviewed the resulting changes and tests.