feat: add built-in OpenAI Codex OAuth support

[guanzi008]

Summary

• add built-in OpenAI Codex account auth to aish, without requiring a traditional API key
• support browser PKCE login, device-code login, and optional codex-cli compatibility fallback
• wire openai-codex/* models into the existing config, setup, shell, and LLM runtime paths
• handle the official Codex backend stream format and token refresh flow, with regression tests

Usage

Login with built-in browser OAuth:

aish models auth login --provider openai-codex

Login on a headless server:

aish models auth login --provider openai-codex --auth-flow device-code

Optional fallback using the local codex CLI:

aish models auth login --provider openai-codex --auth-flow codex-cli

Use an account-scoped model after login:

aish run --model openai-codex/gpt-5.4

Or switch inside the shell:

/model openai-codex/gpt-5.4

Notes:

• openai-codex/* does not require api_key
• auth file resolution supports AISH_CODEX_AUTH_PATH, codex_auth_path, $CODEX_HOME/auth.json, and ~/.codex/auth.json

Testing

• .venv/bin/pytest -q tests/test_openai_codex.py tests/test_cli.py tests/test_shell.py
• 67 passed

[F16shen]

功能上可以先合并。
我会补一个PR，把现在这些 openai-codex specific 的分支收敛成统一的 provider 抽象，方便以后新增其他OAuth provider

[F16shen]

Resloves #38