Refactor server: extract shared helpers, fix tool-call ordering and finish_reason mapping

- Extract callUpstream helper to deduplicate ~30 lines between chatCompletions and responses
- Move HTML templates to internal/server/templates/ via go:embed (server.go 1749→1192 lines)
- Consolidate 4 copies of firstNonEmpty into util.FirstNonEmpty
- Extract chatStreamChunk named type shared by aggregateStream and aggregateResponsesStream
- Fix tool-call ordering: iterate sorted map keys instead of sequential 0..N
- Map upstream finish_reason to Responses API status (length/content_filter → incomplete)
- Surface /v1/models errors as 401/502 instead of silently returning empty 200
- Add Secure cookie flag via isTLSRequest helper
- forEachSSEChunk: use sseDataPayload parser, drop redundant json.Valid, distinguish bufio.ErrTooLong
- Fix StreamIdleTimout typo → StreamIdleTimeout
- sso.go: single Read → io.ReadAll(io.LimitReader), explicit unknown error fallback

internal/zhanlu/client.go

@@ -13,6 +13,7 @@ import (
 
 	"git.misaka.ren/M1saka/zhanlu_proxy/internal/auth"
 	"git.misaka.ren/M1saka/zhanlu_proxy/internal/sign"
+	"git.misaka.ren/M1saka/zhanlu_proxy/internal/util"
 )
 
 type Client struct {
@@ -93,8 +94,8 @@ func (c *Client) ProvisionAPIKey(ctx context.Context, email, organization, team
 	if strings.TrimSpace(email) == "" {
 		return "", fmt.Errorf("profile email is required to provision an API key")
 	}
-	org := firstNonEmpty(organization, "未配置")
-	tm := firstNonEmpty(team, "未配置")
+	org := util.FirstNonEmpty(organization, "未配置")
+	tm := util.FirstNonEmpty(team, "未配置")
 	// Field order matters: the SM2 signature covers the exact JSON body bytes,
 	// matching the plugin's JSON.stringify({email, organization, team}).
 	body, err := json.Marshal(struct {
@@ -195,7 +196,7 @@ func (c *Client) Models(ctx context.Context, apiKey string) ([]string, error) {
 	seen := map[string]bool{}
 	models := make([]string, 0, len(out.Data))
 	for _, m := range out.Data {
-		id := firstNonEmpty(m.ModelName, m.ID, m.ModelInfo.ID)
+		id := util.FirstNonEmpty(m.ModelName, m.ID, m.ModelInfo.ID)
 		if id == "" || seen[id] {
 			continue
 		}
@@ -237,15 +238,6 @@ func findString(m map[string]any, keys ...string) string {
 	return ""
 }
 
-func firstNonEmpty(values ...string) string {
-	for _, v := range values {
-		if strings.TrimSpace(v) != "" {
-			return v
-		}
-	}
-	return ""
-}
-
 const alnum = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
 
 func randomAlnum(n int) string {