fix(codex): durable OAuth refresh lifecycle

Add shared OAuth credential lifecycle manager with provider-aware refresh
decisions. Implement CodexExecutor.refreshCredentials so 401/403 retry
refresh works for Codex, track lastRefreshAt and refresh before the
upstream stale-token window, preserve omitted idToken, and add
per-connection single-flight refresh to avoid refresh-token rotation races.

Merged from PR #1664.

Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/index.js

@@ -59,6 +59,14 @@ export {
   refreshTokenByProvider
 } from "./services/tokenRefresh.js";
 
+export {
+  CODEX_MAX_REFRESH_AGE_MS,
+  shouldRefreshCredentials,
+  refreshProviderCredentials,
+  mergeRefreshedCredentials,
+  mergeProviderSpecificData,
+} from "./services/oauthCredentialManager.js";
+
 // Handlers
 export { handleChatCore, isTokenExpiringSoon } from "./handlers/chatCore.js";
 export { createStreamController, pipeWithDisconnect, createDisconnectAwareStream } from "./utils/streamHandler.js";