feat: land hosted OpenAI device login on main

[roackb2]

Summary

• Land the hosted OpenAI Codex device-code service that was reviewed in feat: add hosted OpenAI device login #260 onto Heddle main.
• Preserve the stateless request/poll contract, explicit pending and expired outcomes, access-token-only runtime credential, and refresh-token discard.
• Restore the public exports, documentation, and unit coverage from the original feature commit without unrelated changes.

Root cause

PR #260 remained based on codex/request-scoped-runtime-credentials after #259 merged. GitHub therefore merged #260 into that feature branch, not main; the merged badge did not mean the device-code API was releaseable from Heddle main.

This branch starts at current origin/main (9ea5bc67) and cherry-picks only the missing feature commit (e1bb5db7).

Verification

• yarn install --frozen-lockfile — includes a successful production build
• yarn typecheck
• yarn lint
• yarn test:unit — 124 files, 732 tests
• git diff --check origin/main...HEAD

Target

roackb2/heddle:main ← codex/land-openai-device-code-auth

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4268051b05

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Accept Codex device responses without expires_at

In the current OpenAI Codex device-auth flow I inspected, /api/accounts/deviceauth/usercode is handled as returning device_auth_id, user_code/usercode, and interval, with the 15-minute expiry enforced locally rather than supplied as expires_at. Requiring this field makes requestCode() reject a successful real response as invalid before the host can show the user code, so hosted device login cannot start against that endpoint unless expires_at is optional or replaced with a local deadline.

Useful? React with 👍 / 👎.