Add Codex Auth workbench

[MisonL]

Summary

• add a dedicated Codex Auth workbench for batch audit, repair, generate, and export flows
• persist Codex Auth health metadata on accounts and expose it in the accounts API and accounts table
• add regression tests for export packaging and API auth coverage

Verification

• python3 -m py_compile src/web/routes/accounts.py src/core/openai/codex_auth_workbench.py src/core/openai/oauth.py
• node --check static/js/accounts.js
• docker run --rm -v /Volumes/Work/code/codex-console:/app -w /app codex-console:codex-auth-dev sh -lc 'pip install --no-cache-dir pytest >/tmp/pytest-install.log && python -m pytest -q tests/test_codex_auth_workbench.py tests/test_security_and_task_routes.py'

Real dev evidence

• deployed this branch to an isolated dev container: codex-console-codex-auth-dev on http://127.0.0.1:16668
• copied 4 real abnormal accounts with missing refresh_token/id_token into data-dev only: 53, 64, 65, 71
• batch audit result: 1 repairable, 3 blocked by add-phone
• account 53 (u1m0ebfcji@mail.431695.xyz) completed the strict Codex Auth flow successfully and was repaired
• accounts 64, 65, 71 remained blocked with a stable reason: OTP returned add-phone and never reached workspace/callback
• after repair, account 53 in data-dev had refresh_token and id_token restored and generated data/codex_auth/53-u1m0ebfcji-mail.431695.xyz/auth.json
• export verification for account 53 returned HTTP 200 and produced a standard managed auth.json zip with access_token, refresh_token, id_token, and account_id

Why this is useful

• the feature can separate truly repairable accounts from accounts blocked by upstream phone gating
• repair success is not theoretical: it restored a real broken account in dev without touching production data
• failed repairs still return actionable reasons instead of silently passing or guessing