fix(codex): allow credential storage fallback

[chioarub]

Summary

• Allow Codex OAuth credentials to use the existing secure-storage fallback path when the OS keyring is unavailable.
• Keep native secure storage as the preferred path.
• Preserve the plaintext fallback warning instead of treating a successful fallback save as an OAuth failure.
• Keep bare mode and incomplete credential validation unchanged.

Why

Fixes #1338. On Linux systems without a working Secret Service / GNOME Keyring, Codex OAuth could complete successfully but OpenClaude failed immediately because credentials could not be saved through native secure storage only.

Behavior

• Native keyring available: Codex credentials are saved there as before.
• Native keyring unavailable: existing fallback storage is used and a warning is preserved.
• Bare mode: credential saving remains disabled.
• Invalid/incomplete credential blobs are still rejected.
• No tokens or secrets are logged.

Out of scope

• Codex OAuth protocol changes
• Provider routing changes
• Model selection changes
• New credential storage backends
• Opengateway / MiMo issues

Testing

• bun install --frozen-lockfile — passed, no changes.
• bun run smoke — passed.
• bun test src/utils/codexCredentials.test.ts — passed, 11 tests.
• bun test src/utils/secureStorage/ — passed, 15 tests.
• bun test src/components/useCodexOAuthFlow.test.tsx — passed, 4 tests.
• bun test src/components/ProviderManager.test.tsx — passed, 23 tests.
• python -m pip install -r python/requirements.txt — passed, requirements already satisfied locally.
• python -m pytest -q python/tests — passed, 44 tests.
• bun run security:pr-scan -- --base upstream/main — passed, no suspicious additions found.
• bun run test:provider with local provider/env credentials scrubbed — passed, 596 tests.
• npm run test:provider-recommendation with local provider/env credentials scrubbed — passed, 78 tests.
• bun install --cwd web --frozen-lockfile — passed, no changes.
• bun run --cwd web typecheck — passed.
• bun run --cwd web build — passed.
• git diff --check — passed.
• bun test --max-concurrency=1 — local full suite failed with 2,879 passing and 5 failing tests outside this PR's changed files: src/utils/geminiAuth.test.ts, src/utils/conversationRecovery.hooks.test.ts, src/components/StartupScreen.test.ts, and src/tools/BashTool/BashTool.errorOutput.test.ts. The first failures were affected by local ADC/provider environment state; all Codex/storage/provider/web workflow checks relevant to this change passed as listed above.

Fixes #1338

[jatmn]

Findings

• [P1] Avoid copying unrelated secrets into plaintext fallback storage
  src/utils/codexCredentials.ts:42
  Changing Codex to use the default getSecureStorage() fallback means saveCodexCredentials() now reads the whole secure-storage document, adds the Codex blob, and hands that full object to createFallbackStorage().update(). If the native vault can be read but the write falls back, the fallback layer writes the entire object to .credentials.json, including unrelated fields such as MCP OAuth tokens, MCP client secrets, trusted device tokens, and plugin secrets. Connecting Codex can therefore downgrade unrelated credentials from native secure storage to plaintext. Please keep the Codex fallback scoped to the Codex record only, or otherwise avoid writing previously native-only secret fields into plaintext when this specific fallback path is used.

[jatmn]

No issues here, LGTM.