feat(auth): sign in with a ChatGPT subscription for inference

Add an OAuth-based path to run Strix on a user's ChatGPT Plus/Pro
subscription instead of a metered API key, modeled on OpenAI's Codex CLI.

Auth:
- strix/auth: Codex OAuth login (authorization-code + PKCE), a 0600 token
  store, refresh-on-expiry, and an AsyncOpenAI client that routes inference
  through the ChatGPT backend (chatgpt.com/backend-api/codex) with a
  per-request auth hook so long scans survive token expiry.
- `strix auth login|logout|status` CLI (browser loopback on :1455 with a
  manual-paste fallback); STRIX_AUTH_MODE=subscription persisted to config.

Inference wiring:
- Subscription branch in configure_sdk_model_defaults installs the Codex
  client and the Responses API.
- _CodexResponsesModel always streams (the backend rejects non-streamed
  requests) and aggregates back for the non-streaming get_response path.
- store=false + encrypted reasoning for the stateless backend; models
  coerced to plan-available names (default gpt-5.4 — 5.5+ apply stricter
  content moderation that interferes with security testing).

UX / reporting:
- Track tokens but report $0.00 in the TUI, completion panel, and web
  viewer run details; record auth_mode in run.json and PostHog/Scarf.
- Graceful, actionable errors for unavailable models and expired sign-in.
- Restyled OAuth callback page (Strix branding + link to strix.ai).

Tests: PKCE/URL/redirect parsing, token refresh + account-id, streaming
aggregation, cost zeroing, CLI routing/provider aliasing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_runner_root_prompt.py

@@ -43,10 +43,12 @@ def _patch_engine_scaffold(
     settings = types.SimpleNamespace(
         llm=types.SimpleNamespace(
             model="openai/gpt-4o",
+            auth_mode="api_key",
             reasoning_effort="high",
             force_required_tool_choice=False,
             timeout=300,
-        )
+        ),
+        runtime=types.SimpleNamespace(max_context_images=3),
     )
     monkeypatch.setattr(runner, "load_settings", lambda: settings)
     monkeypatch.setattr(runner, "configure_sdk_model_defaults", lambda _settings: None)