Sync refreshed Codex auth JSON

[yvette-carlisle]

Summary

• Mirror refreshed account-pool token payloads into the Codex auth target when the active auth.json has the same account_id
• Leave missing, unreadable, invalid, or nonmatching Codex auth files untouched
• Document the refresh mirror behavior for CLI/app-server users

Verification

• cargo test -p decodex token_refresh_
• cargo test -p decodex agent::codex_accounts::tests::
• cargo +nightly fmt --all
• cargo make fmt-check
• cargo make check-rust
• cargo make check-vstyle-rust
• git diff --check