Make OAuth token windows configurable

[dsghi]

Summary

• promote the configurable OAuth access-token and refresh-replay windows already running in production into source control and Bicep
• preserve secure 10-minute/5-minute application defaults while allowing whole-minute deployment overrides from 1 through 1,440
• retain the merged System.Security.Cryptography.Xml 10.0.10 security update from Bump System.Security.Cryptography.Xml from 10.0.8 to 10.0.10 #23
• update the public README and changelog, including the unified ChatGPT/Codex Windows app as working but still under monitoring

Operational context

Production was deployed directly from the previously uncommitted token-window work and is currently configured for a 45-minute access token and a 5-minute replay window. This PR reconciles that deployed behavior with the public repository. It does not deploy or change the live settings by itself.

Validation

• dotnet test devbrain.slnx --configuration Release — 148 passed
• dotnet list devbrain.slnx package --vulnerable --include-transitive --no-restore — no vulnerable packages
• az bicep build --file infra/main.bicep --stdout — passed
• built dependency graph contains System.Security.Cryptography.Xml 10.0.10
• git diff --check — passed