fix: add websocket capability token hash support

[viyatb-oai]

Summary

• Allow app-server websocket capability auth to accept a precomputed SHA-256 digest via --ws-token-sha256.
• Keep token-file support and enforce exactly one capability token source.
• Document the new auth flag.

Testing

• just fmt
• cargo test -p codex-app-server transport::auth::tests
• cargo test -p codex-app-server websocket_capability_token_sha256_args_parse
• cargo test -p codex-cli app_server_capability_token_flags_parse
• cargo clippy -p codex-app-server --all-targets -- -D warnings
• just fix -p codex-cli