refactor(proxy): replace panic-prone unwrap/expect with safe patterns

Harden the proxy module against panics by removing optimistic
unwrap()/expect() calls in favor of pattern matching and graceful
fallbacks:

- copilot_optimizer/cache_injector: bind Value::Array/String directly
  instead of is_array()+as_array().unwrap(); use is_none_or and in-place
  string mutation
- hyper_client: gate the raw-write path with if-let + filter instead of
  has_cases + unwrap()
- gemini_shadow: recover poisoned RwLock via into_inner() rather than
  panicking, with warn logging
- streaming_codex_chat: replace expect("tool state exists") with
  let-else (return/continue)
- merge_tool_results: early-return when messages is absent
- sse: fall back to from_utf8_lossy on the UTF-8 boundary slice

No behavior change on the happy path; all proxy tests pass.

src-tauri/src/proxy/sse.rs

@@ -66,10 +66,11 @@ pub(crate) fn append_utf8_safe(buffer: &mut String, remainder: &mut Vec<u8>, new
             }
             Err(e) => {
                 let valid_up_to = pos + e.valid_up_to();
-                buffer.push_str(
-                    // Safety: from_utf8 guarantees [pos..valid_up_to] is valid UTF-8.
-                    std::str::from_utf8(&input[pos..valid_up_to]).unwrap(),
-                );
+                let valid_slice = &input[pos..valid_up_to];
+                match std::str::from_utf8(valid_slice) {
+                    Ok(valid) => buffer.push_str(valid),
+                    Err(_) => buffer.push_str(&String::from_utf8_lossy(valid_slice)),
+                }
                 if let Some(invalid_len) = e.error_len() {
                     // Genuinely invalid byte(s) – emit U+FFFD and continue.
                     buffer.push('\u{FFFD}');