Upstream routing transport, encoding, and authorization

For auto-routed upstreams, serialize uncompressed JSON instead of replaying the client's Content-Encoding; preserve encoding only for native passthrough or explicit X-Lore-Upstream-URL/X-Lore-Provider routes. OpenAI-protocol upstream requests must always use Authorization: Bearer ${cred.value}, regardless of the caller's scheme. Remote gateway mode must reject every http: upstream before forwarding credentials or bodies, including manual configs and compact fallbacks; allowlists authorize only exact HTTPS origins.