Add Codex ChatGPT authentication runtime

[tibetyalman]

Summary

• add a first-class codex/default runtime backed by the locally authenticated Codex app-server
• load the active Codex account's picker-visible model catalog from the official model/list app-server method instead of hardcoding model names
• expose per-session Codex model and Thinking controls, including each model's supported/default reasoning levels
• pass the selected reasoning effort to turn/start and preserve it across model switches, runtime recreation, and persisted session restore
• recognize local HF_TOKEN development immediately, avoiding a misleading Hugging Face sign-in gate while the real account profile loads
• keep Codex credentials owned by the Codex CLI instead of reading or forwarding cached tokens
• route Web chat turns and streaming events through Codex without Hugging Face Router inference
• expose ML Intern's Hugging Face and research tools to Codex through a dynamic ml_intern namespace
• make Stop cancel the active Codex task, cap a stuck app-server interrupt, recreate the runtime, and end turns that emit no activity for five minutes
• skip automatic HF sandbox preload and HF billing refresh for Codex sessions
• disable the local Codex bridge on Hugging Face Spaces or OAuth-enabled shared servers

Validation

• uv run ruff check .
• uv run ruff format --check .
• uv run pytest -q — 536 passed, 2 skipped
• npm run lint — 0 errors, 2 pre-existing warnings
• npm run build
• real CLI and Web prompts using an existing ChatGPT Codex login
• real Codex dynamic-tool call through ml_intern.hf_papers
• browser-verified live model picker, Thinking menu, and streamed GPT-5.6-Terra + max response
• browser-verified local HF_TOKEN auth loading state and direct Start Session flow as the token owner
• live Web start/stop/retry test: Stop returned in about one second, SSE ended with interrupted, is_processing reset to false, and the next Codex turn completed normally