feat(cli): add OpenAI Codex OAuth authentication support

[roomote-v0]

Related GitHub Issue

Closes: #11926

Description

This PR attempts to address Issue #11926 by extending OpenAI Codex OAuth authentication from the VSCode extension into the CLI.

Changes:

• Add openai-codex as a supported CLI provider in types.ts
• New CLI auth commands:
  • roo auth login-openai - Performs PKCE OAuth flow against OpenAI auth endpoints, stores credentials
  • roo auth logout-openai - Clears stored OpenAI Codex credentials
  • roo auth status-openai - Shows current OpenAI Codex auth status (email, expiration)
• Credential storage (openai-codex-credentials.ts) - Stores OAuth credentials in the vscode-shim secret storage (~/.vscode-mock/global-storage/secrets.json) so the existing OpenAiCodexOAuthManager and OpenAiCodexHandler work transparently when the extension loads
• Provider settings - provider.ts handles openai-codex provider (no API key needed)
• Run flow - run.ts validates OAuth credentials exist when --provider openai-codex is used, and skips the API key requirement

Usage:

# Authenticate with ChatGPT Plus/Pro subscription
roo auth login-openai

# Use OpenAI Codex models
roo --provider openai-codex "your prompt"

# Check auth status
roo auth status-openai

# Log out
roo auth logout-openai

Feedback and guidance are welcome.

Test Procedure

• Added 12 unit tests for credential storage (save, load, clear, has, expiration)
• Ran existing provider and credentials tests to confirm no regressions
• All tests pass: cd apps/cli && npx vitest run src/lib/storage/__tests__/openai-codex-credentials.test.ts

Pre-Submission Checklist

• Issue Linked: This PR is linked to an approved GitHub Issue
• Scope: Changes are focused on the linked issue
• Self-Review: I have performed a thorough self-review of my code
• Testing: New tests have been added for credential storage
• Documentation Impact: CLI README may need updating with new auth commands
• Contribution Guidelines: I have read and agree to the Contributor Guidelines

Documentation Updates

• Yes, the CLI README should be updated to document the new roo auth login-openai / logout-openai / status-openai commands and the --provider openai-codex option.

Additional Notes

• The OAuth flow reuses the same PKCE + local callback server pattern from the VSCode extension (src/integrations/openai-codex/oauth.ts)
• Credentials are stored in the same secret storage location used by the vscode-shim, so the existing OpenAiCodexHandler picks them up transparently via openAiCodexOAuthManager
• Token refresh is handled automatically by the existing openAiCodexOAuthManager when the extension loads

Interactively review PR in Roo Code Cloud

[ArchimedesCrypto]

@roomote mark this ready for review

[roomote-v0]

Fixaroo   See task

Marked this PR as ready for review.