feat(codex): add managed app-server auth flow

[zeno-codebot]

Summary

Add managed, workspace-scoped Codex app-server authentication. An administrator can establish a Codex login once, Optio stores the encrypted auth.json, and Codex workloads receive the hydrated credentials without exposing them broadly as environment variables.

Changes

• Adds the codex_auth_accounts migration, schema, encrypted auth service, and setup endpoints.
• Supports importing a successful codex login from a managed session, then hydrates credentials into task, workflow, review, and persistent-agent pods.
• Adds Settings and setup UI for configuring, importing, and monitoring the managed account.
• Formats all extracted changes with the upstream Prettier configuration.

Testing

• Tests pass (corepack pnpm turbo test)
• Typechecks pass (corepack pnpm turbo typecheck)
• Formatting passes (corepack pnpm format:check)

Related

Clean extraction from cbulock/optio, excluding its unrelated review/reconciler work.

Closes #

Screenshots

Not applicable; the settings and setup interfaces are covered by typechecks and API/unit tests.