Add shared-home account session switching

[patrickallensimpson]

Summary

• implements the existing v2 accountSession/add, accountSession/list, accountSession/switch, and accountSession/logout protocol
• keeps one shared CODEX_HOME for threads, rollouts, config, skills, and memories while isolating each account's credentials
• stores only account/workspace metadata in account-sessions.json; tokens remain in the configured file, keyring, or secrets backend under a per-session namespace
• rejects account mutations while a turn is active, reloads app-server auth after changes, and refreshes workspace-scoped tokens before switching
• documents the lifecycle and updates both stable and experimental generated schemas

Motivation

Using separate Codex homes isolates credentials, but it also fragments local threads and memories. It can additionally make a shared rollout unusable when a forked conversation is validated against a different home. This proposal makes account identity switchable independently of the local session store: one shared home owns the local working context, while each saved account session owns only its credentials and selected workspace.

Relationship to existing work

This builds on the account-session protocol types merged upstream in openai#25469 and provides a current-main implementation of the lifecycle discussed in openai#25383. It also addresses the shared-session use case behind openai#4432 without requiring one CODEX_HOME per auth profile.

The main storage distinction from openai#25383 is that bearer and refresh tokens are never serialized into account-sessions.json. Existing auth backends remain the credential authority, namespaced by an opaque account-session ID.

Safety properties

• token-free metadata index with atomic writes
• UUID validation for credential namespace paths
• serialized mutations and rejection during active turns
• no Debug implementation on the backend token response
• workspace token exchange completes before the active account header changes
• logout removes both metadata and the corresponding credential namespace

Tests

• cargo fmt --all -- --check
• cargo clippy --tests -p codex-app-server -p codex-backend-client -p codex-app-server-protocol
• cargo nextest run --no-fail-fast -p codex-app-server account_sessions_share_codex_home_and_isolate_credentials
• cargo nextest run --no-fail-fast -p codex-app-server-protocol -p codex-backend-client
• stable and experimental schema writer tests

The end-to-end app-server test creates two accounts under one temporary home, switches between them, verifies credential isolation, and asserts that neither token appears in the shared metadata file.

Follow-up scope

This is the server-side lifecycle and storage layer. A UI account picker and a dedicated accountSession/login/start UX can be layered on separately; clients can currently bootstrap the store with list, use the existing login flow, and then call add.

Upstream PR creation was attempted directly but the account was denied the CreatePullRequest permission. This fork PR is the reviewable proposal and branch of record.