[Codex][Codex CLI] Emit auth-failure Sentry telemetry without feedback

Add automatic auth-failure Sentry events for request-level and refresh-token failures, including the early /oauth/token path hit by short-lived CLI commands. Also allow a local DSN override so the non-/feedback path can be validated end to end with a real CLI 401 repro.

Co-authored-by: Codex <noreply@openai.com>

codex-rs/tui/src/lib.rs

@@ -842,6 +842,7 @@ pub async fn run_main(
     let feedback = codex_feedback::CodexFeedback::new();
     let feedback_layer = feedback.logger_layer();
     let feedback_metadata_layer = feedback.metadata_layer();
+    let feedback_auth_event_layer = feedback.auth_event_layer();
 
     if cli.oss && model_provider_override.is_some() {
         // We're in the oss section, so provider_id should be Some
@@ -895,6 +896,7 @@ pub async fn run_main(
         .with(file_layer)
         .with(feedback_layer)
         .with(feedback_metadata_layer)
+        .with(feedback_auth_event_layer)
         .with(log_db_layer)
         .with(otel_logger_layer)
         .with(otel_tracing_layer)