feat(api): support custom OpenAI-compatible endpoints

[TomCN0803]

Summary

Allow users to point codex-security at a custom OpenAI-compatible LLM endpoint. #52

Changes

• CodexSecurityConfig now accepts optional endpoint field (src/config.ts)
• Passes baseUrl through to @openai/codex-sdk in api.ts
• openai_base_url whitelisted in scanPreflightCodexConfig so it survives --codex override sanitization
• New --endpoint CLI flag on scan and bulk-scan commands
• CODEX_ENDPOINT environment variable support (CLI flag takes priority)
• Tests for config, preflight sanitization, and parseCodexOverrides

Usage

# CLI flag
codex-security scan . --endpoint https://my-llm.example.com/v1

# Environment variable
CODEX_ENDPOINT=https://my-llm.example.com/v1 codex-security scan .

# Bulk scan
codex-security bulk-scan repos.csv --output-dir ./results --endpoint https://my-llm.example.com/v1

# Via --codex override
codex-security scan . --codex 'openai_base_url="https://my-llm.example.com/v1"'

[qthequartermasterman]

@TomCN0803 Any chance you plan on merging the changes from main/rebasing this?

[sylvesterkaczmarek]

--endpoint is passed to the live Codex client as baseUrl, but it never enters effectiveConfig / preflightConfig. Scan registration and rerun paths persist/reuse that sanitized config, so a scan started with --endpoint can later lose the custom endpoint while the equivalent --codex openai_base_url=... survives. Could the endpoint be persisted explicitly (or injected as openai_base_url) with a rerun regression?