feat(cli): add openai-codex oauth onboarding and auth flows

[mojomast]

Summary

• add provider capability plumbing and run-path auth branching so openai-codex is treated as OAuth while preserving existing API-key and Roo-token paths
• add extension-host OAuth bridge + onboarding integration for OpenAI Codex, including provider-aware auth commands (roo auth login/status/logout --provider openai-codex)
• add non-interactive fail-fast guidance for unauthenticated openai-codex, update CLI docs, and include follow-up fixes for auth subcommand provider parsing and OAuth browser/manual URL behavior

Validation

• pnpm --filter @roo-code/cli check-types
• pnpm --filter @roo-code/cli test
• pnpm --filter @roo-code/vscode-shim test
• pnpm --filter roo-cline check-types
• pnpm exec vitest run core/webview/__tests__/webviewMessageHandler.spec.ts (from src)

Notes

• backward compatibility kept for API-key providers and openai-native
• reuses extension-managed openai-codex OAuth flow (no duplicate OAuth stack)
• issue progress/final evidence posted on [ENHANCEMENT] Improve provider ingestion onboarding and add OpenAI OAuth #11676

Closes #11676

Interactively review PR in Roo Code Cloud