[CLI] Support account OAuth login in /setup

[hey-mira]

Problem

The CLI /setup flow cannot configure an openai-codex Connection through OAuth. Users in a terminal-only or SSH environment must switch to Maka Desktop or configure an API key.

Current behavior

• /setup already provides the provider picker, editable name and slug step, and searchable model-selection step for API-key Connections.
• Runtime Host already provides the openai-codex OAuth lifecycle.
• The missing piece is the /setup OAuth step and the wiring that connects it to the existing steps.

Desired outcome

A new openai-codex Connection follows this four-step flow inside the existing /setup overlay.

1. Choose provider

Set Up Provider · 1/4 7
Search providers · ↑↓ select · Enter confirm · Esc cancel

Search open

  OpenAI                               openai · add account
→ OpenAI OAuth (ChatGPT / Codex)       openai-codex · add account
  Custom relay (OpenAI Chat-comp       openai-compatible · add account
  Custom relay (OpenAI Responses       openai-responses-compatible · add account
  OpenCode Zen                         opencode · add account
  OpenCode Go                          opencode-go · add account
  OpenRouter                           openrouter · add account

2. Set Connection identity

Set Up Provider · 2/4 OpenAI OAuth (ChatGPT / Codex)
Name this connection, or keep the defaults to auto-assign · Enter continues · Esc returns

Name OpenAI OAuth (ChatGPT / Codex)

Slug codex-subscription

Enter to continue

3. Sign in with OAuth

Set Up Provider · 3/4 OpenAI OAuth (ChatGPT / Codex)
Open the device page and enter the sign-in code · Esc returns

https://auth.openai.com/codex/device

Sign-in code: ABCD-EFGH

⠋ Waiting for browser authorization…

4. Choose models

Set Up Provider · 4/4 OpenAI OAuth (ChatGPT / Codex)
Search models · ↑↓ select · Space toggle · Enter save · Esc back

Search

→ ☑ gpt-5.6-sol
  ☑ gpt-5.5
  ☑ gpt-5.4
  ☑ gpt-5.4-mini
  ☑ gpt-5.3-codex-spark

5 selected · Enter to save

Steps 1, 2, and 4 reuse existing /setup UI and behavior. Step 3 is the only new user-facing step.

The identity entered in step 2 and the models selected in step 4 apply to the same Connection authenticated in step 3.

Existing OAuth Connection

Selecting an existing OAuth Connection reauthorizes that Connection without changing its identity. The identity step is skipped:

Provider 1/3 → OAuth 2/3 → Models 3/3

[hey-mira]

take