feat(llm): add OpenAI Codex provider (Responses API + OAuth)

Add LlmBackend::OpenAiCodex with dual auth support:
- API key mode (api.openai.com, pay-per-token)
- OAuth mode (chatgpt.com via Codex CLI tokens, subscription billing)

Implements the Responses API wire format (/v1/responses) with flat
input/output arrays, instructions field, and flat tool definitions.
Includes token manager with 401 retry and disk reload, setup wizard
integration, config resolution, and 30 unit tests.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

.env.example

@@ -4,7 +4,7 @@ DATABASE_POOL_SIZE=10
 
 # LLM Provider
 # LLM_BACKEND=nearai           # default
-# Possible values: nearai, ollama, openai_compatible, openai, anthropic, tinfoil
+# Possible values: nearai, ollama, openai_compatible, openai, anthropic, tinfoil, openai_codex
 
 # === NEAR AI (Chat Completions API) ===
 # Two auth modes:
@@ -57,6 +57,18 @@ NEARAI_AUTH_URL=https://private.near.ai
 # LLM_BASE_URL=https://api.fireworks.ai/inference/v1
 # LLM_API_KEY=fw_...
 
+# === OpenAI Codex (Responses API) ===
+# Two auth modes:
+#   1. API key: Standard OpenAI billing (api.openai.com/v1/responses)
+#   2. Codex CLI OAuth: ChatGPT subscription billing (chatgpt.com)
+#      Reads token from ~/.codex/auth.json (or $CODEX_HOME/auth.json)
+# OPENAI_CODEX_MODEL=gpt-5.3-codex
+# LLM_BACKEND=openai_codex
+# OPENAI_CODEX_API_KEY=sk-...           # API key mode
+# CODEX_AUTH_PATH=~/.codex/auth.json    # OAuth mode (default path)
+# OPENAI_CODEX_ACCOUNT_ID=...           # Required for ChatGPT endpoint
+# OPENAI_CODEX_BASE_URL=...             # Override base URL
+
 # For full provider setup guide see docs/LLM_PROVIDERS.md
 
 # Channel Configuration