feat(codex): add ChatGPT subscription provider

[amphetamarina]

Summary

• add a ChatGPT subscription-backed Codex provider with device authorization, Codex CLI credential import, private refreshable credential storage, logout, and one-time 401 recovery
• route authenticated model discovery and Responses traffic through the fixed Codex subscription transport while protecting required endpoint, body, and header invariants
• preserve Codex-native reasoning and function-call item identity across streaming, transcript replay, retained compaction history, and subsequent requests while excluding opaque reasoning from visible memory
• normalize malformed Codex-only tool history, improve Responses terminal/error handling and SSE framing, and retain existing behavior for non-Codex providers
• integrate authenticated Codex setup into onboarding and model settings with English and Chinese UI strings

Provider isolation and compatibility

• Codex-specific behavior requires the provider ID, openai-responses protocol, and canonical https://chatgpt.com/backend-api/codex URL
• non-Codex endpoint routing, assistant-history serialization, extraBody, API-key handling, and provider settings behavior remain unchanged
• Codex-native metadata survives canonical cloning and transcript replay; full compaction intentionally discards metadata for summarized-away history
• memory extraction continues to include visible text/tool-result previews only and does not expose encrypted reasoning content
• the provider uses PilotDeck's existing tools and agent instructions; it does not replace tool schemas, prompts, planning, compaction, or shell behavior with a separate Codex runtime

Security and transport

• credentials are stored in PilotDeck's private auth file using atomic writes and restrictive filesystem permissions
• device secrets remain server-side behind opaque state, with expiry, polling-interval enforcement, and concurrent-poll protection
• authorization, account identity, SSE beta headers, and per-attempt request IDs cannot be overridden by custom provider headers
• generic provider extraBody cannot replace Codex request invariants such as input, stream, store, or reasoning configuration

Validation

Run with Node v22.23.2 through mise:

• backend TypeScript typecheck passed
• focused backend provider regressions: 39/39 passed before final invariant coverage; final core provider set: 34/34 passed
• focused UI/server regressions: 62/62 passed
• changed React files ESLint passed
• git diff --check passed
• full backend suite: 237 passed, 0 failed, 7 cancelled at the repository-wide 60-second timeout in existing long-running file-range tests
• full UI suite: 473 passed, 8 failed; existing failures are four node:sqlite Vite bundling tests and four streamSmoother timer tests, plus the existing Playwright/Vitest collection issue

Notes

• README.md and README.zh.md are unchanged from upstream main.
• the repository-wide UI typecheck remains blocked by the existing incompatible React type trees; focused tests and changed-file lint pass.