feat(cli): support OAuth login in setup

[hey-mira]

Summary

• Add openai-codex to the existing flat /setup picker. New OAuth accounts now reuse the Connection name/slug step (Provider → Identity → OAuth → Models), while existing accounts retain the three-step reauthorization flow.
• Carry an edited identity through the Runtime Host protocol and durable OAuth transaction. Untouched defaults still send the legacy bare create target; requested-slug admission and commit races return stable slug_taken without leaving a Connection or credential behind.
• Keep OAuth exchange/token storage in Runtime Host, then seed and save models for the exact authenticated Connection, repair a missing default target, and refresh the running TUI catalog. Lost start/cancel responses reconcile by stable attempt id, and cancellation waits for the Host's authoritative terminal outcome. The API-key transaction is unchanged.

Fixes #4606

Verification

• npm run lint
• npm run format:check
• npm run typecheck
• npm run check:tui-copy
• npm run check:asf-headers
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• node scripts/protocol-epoch-check.mjs --base origin/main --head HEAD
• Storage suite: 1111 passed, 0 failed, 10 skipped
• CLI suite: 807 passed, 0 failed, 3 skipped
• Runtime Host suite: 1677 passed, 1 failed, 12 skipped
• Website suite after syncing the latest main dependencies: 8 passed, 0 failed

The sole Runtime Host failure is reproducible in production Host executes Bash against the current live sandbox boundary; neither that test nor its execution implementation is touched by this PR. All OAuth and changed-path suites pass.

Review focus

Runtime Host remains the identity and persistence authority: the CLI never creates a placeholder or renames after login. The new closed OAuth identity/error shapes move the compatibility epoch from 109 to 110. Local TUI OAuth presentation still uses a short-lived sibling Host connection, and shutdown drains pending cancellation/commit arbitration.

Final automated Standards and Spec reviews found no actionable code findings. Independent target validation remains at the wire, operation-input, transaction-document, and receipt-document trust boundaries so their recovery formats stay decoupled.

Draft follow-up

• Attach a before/after screenshot or recording from a real OpenAI device login.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented the CLI, Runtime Host, and storage changes; added tests and documentation; and performed a two-axis Standards/Spec review. The commit includes a Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck, protocol guard, and affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No