Allow API-key auth for remote exec-server registration

[sdcoffey]

Overview

Allow remote codex exec-server registration to use existing API-key auth while restricting where those credentials can be sent.

• Accept CodexAuth::ApiKey for the normal --remote registration path.
• Restrict API-key remote registration to HTTPS openai.com and openai.org hosts and subdomains, with explicit HTTP loopback support for local development.
• Disable registry registration redirects so credentials cannot be forwarded to an unvalidated destination.
• Retain --use-agent-identity-auth as the explicit Agent Identity path.
• Document remote registration using CODEX_API_KEY.

Big picture

Callers can now provide an API key directly to exec-server registration without first establishing ChatGPT login state:

CODEX_API_KEY="$OPENAI_API_KEY" \
codex exec-server \
  --remote "https://<host>.openai.org/api" \
  --environment-id "$ENVIRONMENT_ID"

Validation

• cargo fmt --all (just fmt is not installed on this host)
• cargo test -p codex-cli -p codex-exec-server