Add proactive token refresh lead times for providers and implement Codex proxy management

src/sse/services/tokenRefresh.js

@@ -20,7 +20,8 @@ import {
   refreshTokenByProvider as _refreshTokenByProvider,
   formatProviderCredentials as _formatProviderCredentials,
   getAllAccessTokens as _getAllAccessTokens,
-  refreshKiroToken as _refreshKiroToken
+  refreshKiroToken as _refreshKiroToken,
+  getRefreshLeadMs as _getRefreshLeadMs
 } from "open-sse/services/tokenRefresh.js";
 
 export const TOKEN_EXPIRY_BUFFER_MS = BUFFER_MS;
@@ -196,10 +197,12 @@ export async function checkAndRefreshToken(provider, credentials) {
     const now       = Date.now();
     const remaining = expiresAt - now;
 
-    if (remaining < TOKEN_EXPIRY_BUFFER_MS) {
+    const refreshLead = _getRefreshLeadMs(provider);
+    if (remaining < refreshLead) {
       log.info("TOKEN_REFRESH", "Token expiring soon, refreshing proactively", {
         provider,
         expiresIn: Math.round(remaining / 1000),
+        refreshLeadMs: refreshLead,
       });
 
       const newCreds = await getAccessToken(provider, creds);