Support explicit MCP OAuth client IDs

[mzeng-openai]

Why

Some MCP OAuth providers require a pre-registered public client ID and cannot rely on dynamic client registration. Codex already supports MCP OAuth, but it had no way to supply that client ID from config into the PKCE flow.

What changed

• add oauth.client_id under [mcp_servers.<server>] config, including config editing and schema generation
• thread the configured client ID through CLI, app-server, plugin login, and MCP skill dependency OAuth entrypoints
• configure RMCP authorization with the explicit client when present, while preserving the existing dynamic-registration path when it is absent
• add focused coverage for config parsing/serialization and OAuth URL generation

Verification

• cargo test -p codex-config -p codex-rmcp-client -p codex-mcp -p codex-core-plugins
• cargo test -p codex-core blocking_replace_mcp_servers_round_trips --lib
• cargo test -p codex-core replace_mcp_servers_streamable_http_serializes_oauth_resource --lib
• cargo test -p codex-core config_schema_matches_fixture --lib

Notes

Broader local package runs still hit unrelated pre-existing stack overflows in:

• codex-app-server::in_process_start_clamps_zero_channel_capacity
• codex-core::resume_agent_from_rollout_uses_edge_data_when_descendant_metadata_source_is_stale

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 00b17c2659

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".