Refactor server: extract shared helpers, fix tool-call ordering and finish_reason mapping

- Extract callUpstream helper to deduplicate ~30 lines between chatCompletions and responses
- Move HTML templates to internal/server/templates/ via go:embed (server.go 1749→1192 lines)
- Consolidate 4 copies of firstNonEmpty into util.FirstNonEmpty
- Extract chatStreamChunk named type shared by aggregateStream and aggregateResponsesStream
- Fix tool-call ordering: iterate sorted map keys instead of sequential 0..N
- Map upstream finish_reason to Responses API status (length/content_filter → incomplete)
- Surface /v1/models errors as 401/502 instead of silently returning empty 200
- Add Secure cookie flag via isTLSRequest helper
- forEachSSEChunk: use sseDataPayload parser, drop redundant json.Valid, distinguish bufio.ErrTooLong
- Fix StreamIdleTimout typo → StreamIdleTimeout
- sso.go: single Read → io.ReadAll(io.LimitReader), explicit unknown error fallback

internal/server/templates.go

@@ -0,0 +1,49 @@
+package server
+
+import (
+	"embed"
+	"fmt"
+	"html/template"
+)
+
+// templateFS holds the rendered admin/login HTML pages. Keeping them as
+// separate files (rather than inline raw-string literals in server.go) gives
+// them real syntax highlighting and keeps server.go focused on handlers.
+//
+//go:embed templates/*.html
+var templateFS embed.FS
+
+var (
+	loginTemplate       = mustParseTemplate("login.html", "login")
+	loginResultTemplate = mustParseTemplate("login_result.html", "login-result")
+	adminTemplate       = mustParseTemplateFuncs("admin.html", "admin", template.FuncMap{
+		"pct": func(f float64) string { return fmt.Sprintf("%.1f%%", f*100) },
+		"rate": func(cached, prompt int64) string {
+			if prompt <= 0 {
+				return "0%"
+			}
+			return fmt.Sprintf("%.1f%%", float64(cached)/float64(prompt)*100)
+		},
+		"human": humanNum,
+	})
+)
+
+// mustParseTemplate reads a single embedded template file and parses it,
+// panicking on error (a malformed template is a build-time mistake).
+func mustParseTemplate(filename, name string) *template.Template {
+	data, err := templateFS.ReadFile("templates/" + filename)
+	if err != nil {
+		panic("embed template " + filename + ": " + err.Error())
+	}
+	return template.Must(template.New(name).Parse(string(data)))
+}
+
+// mustParseTemplateFuncs is mustParseTemplate with a FuncMap registered before
+// parsing, so the template body may reference the custom functions.
+func mustParseTemplateFuncs(filename, name string, funcs template.FuncMap) *template.Template {
+	data, err := templateFS.ReadFile("templates/" + filename)
+	if err != nil {
+		panic("embed template " + filename + ": " + err.Error())
+	}
+	return template.Must(template.New(name).Funcs(funcs).Parse(string(data)))
+}