fix(codex): bound token refresh and cool down repeated failures

[rexdotsh]

Summary

• Bound Codex OAuth token refresh HTTP calls to 15 seconds.
• Let ordinary concurrent callers wait up to 20 seconds for an in-flight refresh, rather than failing after 3 seconds while the first refresh can still be running. Auth-failure callers retain their existing 30-second wait.
• After a failed Codex refresh, skip repeated token-endpoint calls for 30 seconds (including forced refreshes); reconnecting clears the failure state.

Tests cover a slow ordinary refresh with two callers, no immediate second OAuth call after failure, retry after the cooldown, and the presence of a fetch abort signal. Audit finding #8 only; no changes to Claude refresh or #54 credential-save safety. bun test (143 passing), bun lint, bun typecheck. No live OAuth call or service restart. Leave unmerged for review.