fix(codex): reconnect expired OAuth accounts from chat

[Harry19081]

Summary

• recognize expired Codex OAuth credentials in chat errors and offer a direct reconnect action
• wait for Key Vault initialization, resolve the existing Codex account, and replace its credentials
• auto-start the Codex sign-in wizard and return to the failed session after saving
• add complete error copy across all 13 common locales
• include a scoped 10-layer architecture audit

Split from #442. This PR is stacked on #468, which supplies Tauri runtime-aware OAuth callback routing.

Validation

• 20 targeted Vitest tests for route encoding and error classification
• targeted ESLint for all 18 changed TypeScript and TSX files
• scoped TypeScript pre-commit check
• common errors.* i18n completeness across 13 locales — 0 missing

Stack

1. fix(auth): use Tauri runtime for desktop OAuth #468 — Tauri OAuth runtime routing
2. This PR — Codex expired-login repair flow

Retarget this PR to develop after #468 merges.