feat(codex-oauth): manual callback URL paste for SSH / remote sessions (#1288)

[0xfandom]

Summary

Closes #1288.

Codex OAuth needed the browser to reach the openclaude host's localhost:1455 callback. Over SSH / containerized installs that callback resolves to the user's workstation (where nothing is listening), so the redirect lands on a dead URL and the /provider Codex flow hangs with no way to recover except Ctrl+C / closing the terminal.

This PR mirrors the manual-paste recovery the xAI OAuth flow already has:

1. CodexOAuthService exposes submitManualCallback(input). It accepts either the full redirected URL or just its query string, parses code + state, validates state against the in-flight flow, and resolves the same authorization code the loopback would have produced.
2. startOAuthFlow Promise.races the loopback listener against a manual-paste promise — whichever produces the code first wins; the token-exchange + cleanup path is unchanged.
3. useCodexOAuthFlow surfaces submitManualCallback on the waiting status.
4. CodexOAuthSetup (in ProviderManager) renders a paste input under the waiting copy. When SSH_CONNECTION / SSH_CLIENT is set, a yellow banner explains why the loopback redirect failed; non-SSH sessions get a dim hint covering containerized / remote setups.
5. Bad input (missing code, mismatched state, ?error=access_denied, unparseable URL) renders inline under the input without unmounting the flow, so users can retry without restarting OAuth.

The hook keeps existing test seams intact — the new submitManualCallback is added to the Pick<CodexOAuthService, …> surface and existing mocks were extended with a one-line stub.

Test plan

• bun test src/services/api/codexOAuth.test.ts — new manual-paste test covers state mismatch, missing code, ?error=…, and the happy path
• bun test src/components/useCodexOAuthFlow.test.tsx — 4 existing tests still pass with the extended mock surface
• bun test src/components/ProviderManager.test.tsx — 24 tests still pass (no regressions in the Codex setup screen)
• bun run typecheck — no new errors introduced; preexisting as typeof fetch / FakeAuthCodeListenerInstance complaints are upstream
• Manual repro on a fresh SSH host: /provider → Codex → copy auth URL → login in laptop browser → paste the redirected http://localhost:1455/auth/callback?code=…&state=… URL into the CLI → tokens persist and Codex OAuth profile appears