feat(openai): add optional custom base URL to the OpenAI integration

Add an optional custom OpenAI-compatible base URL to the per-account OpenAI
integration (/app/accounts/{id}/settings/integrations/openai) so account owners
can point label suggestions / reply suggestions at a self-hosted or proxy
endpoint (vLLM, OpenRouter, etc.) instead of the default api.openai.com.

- config/integration/apps.yml: add 'base_url' to the openai settings schema +
  form (optional custom URL input).
- lib/integrations/llm_base_service.rb: api_base resolves per-account
  hook.settings['base_url'] -> CAPTAIN_OPEN_AI_ENDPOINT -> api.openai.com.
- lib/integrations/openai/key_validator.rb: valid? accepts an optional base_url
  keyword; api_base uses it first (backward-compatible).
- app/models/integrations/hook.rb: fail-closed validation rejecting a present
  but non-https base_url; both KeyValidator callers pass the hook base_url.

Approved by independent five-key pre-commit review deleg_1c66a89b
(passed=true, blocking arrays empty).

lib/integrations/llm_base_service.rb

@@ -83,8 +83,14 @@ class Integrations::LlmBaseService
     self.class::CACHEABLE_EVENTS.include?(event_name)
   end
 
+  # Resolve the OpenAI-compatible API base URL in priority order:
+  # 1. Per-account custom base_url set on the OpenAI integration hook (if any)
+  # 2. Instance-level CAPTAIN_OPEN_AI_ENDPOINT (if any)
+  # 3. Default https://api.openai.com/
   def api_base
-    endpoint = InstallationConfig.find_by(name: 'CAPTAIN_OPEN_AI_ENDPOINT')&.value.presence || 'https://api.openai.com/'
+    endpoint = hook.settings['base_url'].presence ||
+               InstallationConfig.find_by(name: 'CAPTAIN_OPEN_AI_ENDPOINT')&.value.presence ||
+               'https://api.openai.com/'
     endpoint = endpoint.chomp('/')
     "#{endpoint}/v1"
   end

lib/integrations/openai/key_validator.rb

@@ -1,7 +1,7 @@
 module Integrations::Openai::KeyValidator
   TIMEOUT_SECONDS = 5
 
-  def self.valid?(api_key)
+  def self.valid?(api_key, base_url: nil)
     return false if api_key.blank?
 
     connection = Faraday.new do |f|
@@ -9,7 +9,7 @@ module Integrations::Openai::KeyValidator
       f.options.open_timeout = TIMEOUT_SECONDS
     end
 
-    response = connection.get("#{api_base}/models") do |req|
+    response = connection.get("#{api_base(base_url)}/models") do |req|
       req.headers['Authorization'] = "Bearer #{api_key}"
     end
 
@@ -19,8 +19,12 @@ module Integrations::Openai::KeyValidator
     true
   end
 
-  def self.api_base
-    endpoint = InstallationConfig.find_by(name: 'CAPTAIN_OPEN_AI_ENDPOINT')&.value.presence || 'https://api.openai.com/'
+  # Resolve the API base URL: prefer an explicit per-account custom base_url,
+  # then the instance-level CAPTAIN_OPEN_AI_ENDPOINT, else default api.openai.com.
+  def self.api_base(base_url = nil)
+    endpoint = base_url.presence ||
+               InstallationConfig.find_by(name: 'CAPTAIN_OPEN_AI_ENDPOINT')&.value.presence ||
+               'https://api.openai.com/'
     "#{endpoint.chomp('/')}/v1"
   end
 end