fix(limits): bound stale Codex token refresh

[pitimon]

Summary

• create the timeout-wrapped provider fetch before the serial stale-Codex refresh prelude
• pass that AbortSignal-enabled fetch into refreshCodexTokens
• keep the same configured providerTimeoutMs contract for OAuth refresh and provider requests
• prove joined callers settle and the single-flight slot can retry after timeout

Verification

• RED on origin/main: hanging refresh held the shared flight past the test deadline
• GREEN: hanging fetch receives an abort; joined callers share the bounded result; reset starts a successful second refresh
• focused usage-limits, Codex refresh, failure-visible, and single-flight suites pass
• npm run ci:local passes: dashboard 320/320, root 1036/1036, all validators green
• independent review: PASS, no blocking findings
• static scan: no secrets, debug artifacts, or dangerous execution added

Closes #144