OpenAI Codex (ChatGPT OAuth) provider.

This mirrors Codex CLI / ChatGPT OAuth:
1. Generate PKCE verifier + S256 challenge.
2. Open auth.openai.com with Codex's public client id.
3. Let the browser redirect to the registered localhost callback,
   then paste the final redirect URL/code back into Vis.
4. Exchange the code for ChatGPT access/refresh tokens.
5. Refresh the access token before expiry and expose it to Vis as
   the provider token.

Tokens are persisted at `~/.vis/openai-codex-auth.json`. The access
token is a JWT; Codex requests require the embedded ChatGPT account
id, so this namespace validates/extracts it during login/refresh.

OpenAI Codex dynamic quota checker.

Fetches `https://chatgpt.com/backend-api/wham/usage`, selects the
regular Codex bucket (or the nested Codex Spark bucket), then exposes
the 5h and 7d percentage windows as normalized Vis limit rows.