fix(codex): harden buffered transport retries

[troyhoffman-oss]

Summary

• make Codex auto transport completion-gated and replay statusless resets, 429, 5xx, overload events, and continuation fallback safely before downstream bytes are released
• replace the HTTP whole-request timeout with header plus per-chunk idle timeouts and preserve exhausted upstream status and Retry-After semantics
• share the Codex client, make OAuth refresh async and single-flight, observe durable credential rotation/logout, and prevent stale 401 refresh races
• add jittered backoff and structured retry/exhaustion logs
• document the latency tradeoff and native-Codex OAuth fallback ownership boundary

Safety property

A failed upstream attempt is fully buffered and discarded. Claude Code never receives its text or tool calls, so replay cannot duplicate Claude-side tool execution.

Verification

• cargo fmt --all --check
• cargo test --all --locked: all unit, CLI, WebSocket, server, and 17 cutover smoke tests pass
• cargo build --locked
• handler-level failure injection confirms partial failed output is never released
• regression coverage includes post-header body reset, 503 then success, response.failed overload, 429 Retry-After, continuation fallback followed by reset, concurrent refresh, and durable rotation/logout

Repository-wide strict Clippy currently reports existing warnings in untouched Cursor, Kimi, and Codex translation files. Running Clippy with only those baseline lint categories allowed passes the full changed tree with -D warnings.

[raine]

This PR seems to be adding lots of mixed concerns which makes it harder to review and understand

[raine]

I started reviewing and pulling changes commit by commit to main from this PR