Address self-review findings ahead of code review:
- auth_cli: require the OAuth `state` on the automated loopback callback
(reject missing/mismatched — CSRF), keep manual paste lenient since it's
user-initiated. Add tests for _finish state handling.
- codex: drop the redundant chatgpt-account-id from client default_headers;
the per-request auth hook already stamps it (single source of truth).
- main: tighten the "sign-in expired" hint to match `error code: 401` /
`http 401` rather than a bare "401" substring that could misfire.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
