Fix stale Codex auth reuse in embedded CLIProxy

[xxx7xxxx]

Summary

• Refreshes Codex provider auth from ~/.codex/auth.json before reusing existing CLIProxy auth records.
• Preserves newer CLIProxy auth when it is fresher than Codex home auth.
• Extracts JWT expiry during Codex auth import so CLIProxy can refresh tokens before requests hit 401.
• Stabilizes an async serve test that waited for browser fallback before the fallback hint was printed.