feat: implement circuit breaker, fix auth vulnerability

TODO.md

@@ -21,14 +21,22 @@
 - [x] System Metrics endpoint (`/api/system/metrics` using `gopsutil`)
 - [x] Fixed dashboard 404s and 500s
 
-## Feature Parity Checklist (High Priority)
+## Planned Resolutions (High Priority)
+
+### Security Fixes
+- [x] **Critical:** Fix `AuthMiddleware` to reject invalid tokens instead of falling back to insecure prefix derivation.
+
+### Feature Parity Checklist (High Priority)
 
 ### OpenAI Provider
 - [x] Tool Calling
 - [x] Multimodal (Images) support
 - [x] Accurate usage parsing (cached & reasoning tokens)
-- [ ] Reasoning Content (CoT) support for `o1`, `o3` (need to ensure it's parsed in responses)
-- [ ] Support for `/v1/responses` API (required for some gpt-5/o1 models)
+### Feature Parity: OpenAI Provider Enhancements
+- [x] **Reasoning Content (CoT) Support (`o1`/`o3`):**
+    - [x] Infrastructure verified. `reasoning_content` is mapped in request/response structures.
+- [x] **Support for `/v1/responses` API:**
+    - [x] Implemented new route in `internal/server/server.go`.
 
 ### Gemini Provider
 - [x] Tool Calling (mapping to Gemini format)
@@ -55,7 +63,7 @@
 
 ## Infrastructure & Middleware
 - [ ] Implement Rate Limiting (`golang.org/x/time/rate`)
-- [ ] Implement Circuit Breaker (`github.com/sony/gobreaker`)
+- [x] Implement Circuit Breaker (`github.com/sony/gobreaker`)
 
 ## Verification
 - [ ] Unit tests for feature-specific mapping (CoT, Tools, Images)