feat: add OpenAI Codex OAuth provider

[perlantir]

Summary

• Adds a chat-only openai-codex provider that reuses existing Hermes/Codex OAuth auth files instead of requiring OPENAI_API_KEY.
• Adds a safe OAuth loader/refresh path with token redaction and no credential printing.
• Wires Codex chat through the Codex Responses endpoint and documents the implementation plan/limits.

Security notes

• Does not export OAuth access/refresh tokens to env vars.
• Tests use fake token values only.
• Codex OAuth is chat-only; embeddings remain on supported embedding providers such as Ollama/OpenAI API-key providers.

Test plan

• bun test test/ai/codex-oauth.test.ts
• bun test test/ai
• bun run typecheck
• bun run check:privacy
• bun run check:newlines
• gbrain providers list | grep -i openai-codex

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews