Add managed Codex app-server auth flow

[zeno-codebot]

Summary

• add a first-class managed Codex auth account model and setup API flow
• support interactive codex login capture/import plus shared auth.json hydration for repo pods
• switch Codex workers/runtime wiring to use the managed app-server auth path and updated CLI invocation

Testing

• corepack pnpm typecheck --filter=@optio/web --filter=@optio/api --filter=@optio/agent-adapters
• corepack pnpm --dir apps/api test -- src/routes/setup.test.ts src/workers/task-worker.test.ts

Notes

• excludes unrelated LAN/kind setup and README changes from the dirty source checkout
• test runs still emit the existing Redis ECONNREFUSED 127.0.0.1:6379 warnings in this environment

[zeno-codebot]

Closing this because the requested PR target was Cameron's fork, not upstream. The branch remains available on cbulock/optio and the fork-local PR is the canonical review thread.