Record OAuth provenance and login identity for account tokens (#55397)

## Why

Token refresh needs the issuer and client ID used at login. Unverified token claims cannot establish that authority, and OAuth error bodies may echo credentials.

## What changed

- Save `oauth_provenance` and a new `login_owner_id` on browser and device-code login. Preserve the login identifier through token rotation.
- Refresh using the recorded issuer and client ID, retaining the existing endpoint override and fallback behavior for legacy records. Clear provenance when an override changes the endpoint or when a response without token rotation encounters a concurrently replaced refresh token.
- Keep both metadata fields optional for older records without inferring provenance from token claims.
- Remove backend token error details from structured logs and refresh error messages.
- Box large futures in token refresh, MCP initialization, and embedded app-server test startup to reduce surrounding async frame sizes.

## Testing

Add coverage for legacy record compatibility and metadata round trips, browser and device-code login persistence, refresh using recorded OAuth settings, metadata preservation through rotation, and provenance clearing for a superseded refresh token.

GitOrigin-RevId: b6b5d2fcbe2a284a171a242c1a17128af55f1024

codex-rs/app-server/tests/common/auth_fixtures.rs

@@ -178,6 +178,8 @@ pub fn write_chatgpt_auth(
         id_token,
         access_token: fixture.access_token,
         refresh_token: fixture.refresh_token,
+        oauth_provenance: None,
+        login_owner_id: None,
         account_id: fixture.account_id,
     };