feat: add managed codex auth account flow

[zeno-codebot]

Summary

• add a managed Codex auth account flow with setup API/UI support
• hydrate Codex app-server auth into task containers without broad secret env exposure
• cover workflow and persistent Codex bootstrap regressions plus workspace-scoped setup status detection

Testing

• node /root/.cache/node/corepack/v1/pnpm/10.11.0/bin/pnpm.cjs --dir /tmp/optio-codex-auth --filter @optio/api test -- src/routes/setup.test.ts src/workers/workflow-worker.test.ts
• node /root/.cache/node/corepack/v1/pnpm/10.11.0/bin/pnpm.cjs --dir /tmp/optio-codex-auth --filter @optio/api typecheck
• node /root/.cache/node/corepack/v1/pnpm/10.11.0/bin/pnpm.cjs --dir /tmp/optio-codex-auth --filter @optio/web typecheck
• node /root/.cache/node/corepack/v1/pnpm/10.11.0/bin/pnpm.cjs --dir /tmp/optio-codex-auth --filter @optio/agent-adapters typecheck
• node /root/.cache/node/corepack/v1/pnpm/10.11.0/bin/pnpm.cjs --dir /tmp/optio-codex-auth --filter @optio/shared typecheck