Fetch account security reminders through app-server (#60082)

## Why

Security reminder requests need to use app-server's active authentication and HTTP runtime, with results bound to the login that fetched them.

## What changed

- Add `account/securitySetup/read`, returning an optional notice with account and user IDs, plus generated protocol schemas and bindings.
- Fetch reminders in app-server only for a matching saved ChatGPT login. Return `notice: null` for ineligible, unavailable, or timed-out reads, and discard results when the login changes during the request.
- Route TUI reminder reads through the new method while retaining notice validation and identity checks. Unsupported servers produce no reminder.

## Testing

Add coverage for shared runtime use across restarts, ineligible authentication modes, and login changes during a fetch. Update TUI coverage for unavailable, unsupported, and mismatched notices.

GitOrigin-RevId: 426fee7ce98df17970957c06876881bc5b005196

codex-rs/app-server-protocol/schema/json/ClientRequest.json

@@ -8662,6 +8662,29 @@
       "title": "Account/logoutRequest",
       "type": "object"
     },
+    {
+      "properties": {
+        "id": {
+          "$ref": "#/definitions/RequestId"
+        },
+        "method": {
+          "enum": [
+            "account/securitySetup/read"
+          ],
+          "title": "Account/securitySetup/readRequestMethod",
+          "type": "string"
+        },
+        "params": {
+          "type": "null"
+        }
+      },
+      "required": [
+        "id",
+        "method"
+      ],
+      "title": "Account/securitySetup/readRequest",
+      "type": "object"
+    },
     {
       "properties": {
         "id": {