Refresh ChatGPT auth before expiry

[cbusillo]

Summary

• refresh ChatGPT access tokens inside a small pre-expiry window instead of waiting until they are already expired
• use the OpenAI auth backend's accepted codex_cli_simplified_flow parameter for login
• add focused regressions for both behaviors

Upstream

• imports/adapts 15d85ea3ca from just-every/code
• imports the login auth parameter part of 76937a5ba3 from just-every/code

Validation

• cargo test -p code-core proactive_refresh_only_triggers_for_stale_chatgpt_auth
• cargo test -p code-login authorize_url_uses_codex_simplified_flow_parameter
• ./build-fast.sh