fix(server): remove retired Codex models after refresh - #9773

Eligibility
This narrowly fixes stale Codex model entries by treating successful discovery as authoritative while preserving models during transient startup or probe failures. The production change is isolated and accompanied by coverage for cache persistence, restarts, authentication states, and clearing behavior.

Notes:
No code owners found in target merge base 8e056a0