feat: support Codex subscription sign-in

[roackb2]

Summary

• Add an explicit API key or Codex subscription model-access choice in the agent panel.
• Acquire an OpenAI device-code credential through the authenticated SlideX agent server.
• Keep API keys, device challenges, and Codex access tokens only in browser memory and forget them on refresh.
• Send one typed model credential with each run-start request.

Security boundary

• Verification links are accepted only from https://auth.openai.com.
• SlideX never asks for the OpenAI password and never writes model credentials to browser storage.
• The server remains responsible for exchanging device codes and must not persist runtime credentials.

Dependency checkpoint — do not merge yet

This editor PR depends on roackb2/slidex-agent-server#27. The server PR in turn depends on roackb2/heddle#261 being merged, published, and replacing its temporary commit pin with an exact registry version. Keep this PR in draft until that chain is released and the real end-to-end device flow is verified.

Verification

• npx tsc --noEmit
• npm run lint
• npm test — 204 tests
• npm run test:agent — 14 tests
• npm run test:agent:e2e — 20 browser tests
• npm run build — 47 routes
• npm run build:scan-secrets — PASS