[codex] Put VPN and proxy Freebuff users in limited mode

[brandonkachen]

Summary

• Stop treating corroborated VPN/proxy/residential-proxy Freebuff privacy detections as a hard block.
• Let those requests flow through the existing limited-mode path, which restricts access to DeepSeek V4 Flash.
• Keep Cloudflare Tor country detection as a hard block.
• Update Freebuff session/chat completion tests and docs to match the new behavior.

Validation

• bun test web/src/server/__tests__/free-mode-country.test.ts web/src/app/api/v1/freebuff/session/__tests__/session.test.ts web/src/app/api/v1/chat/completions/__tests__/completions.test.ts
• bun run --cwd common typecheck
• bun run --cwd web typecheck
• git diff --check