feat(cli): expose read-only Codex account and instance data

[agent-sije70cmyk]

Summary

• expose read-only Codex account, current-account, quota, and instance listing through the CLI;
• add stable JSON output for the new read-only operations;
• share AES-256-GCM account-detail storage between cockpit-core and Tauri;
• decrypt encrypted Codex account details in CLI without creating keys, repairing files, migrating plaintext, or refreshing credentials;
• add tests proving encrypted data and the secure-storage key are not rewritten by read-only commands.

Dependency

This PR is stacked on #2356 and includes its commits. Please merge #2356 first; this PR adds the Codex read-only operations on top of the shared CLI foundation.

CLI examples

cockpit-cli --json list codex
cockpit-cli --json current codex
cockpit-cli --json quota codex
cockpit-cli --json instances codex

Existing CLI commands remain compatible. Account mutations, quota refresh, process launching, and AGY support are intentionally out of scope.

Validation

• cargo test -p cockpit-cli -p cockpit-core --all-targets — passed;
• cargo clippy -p cockpit-cli -p cockpit-core --all-targets — passed with existing warnings;
• cargo check -p cockpit-tools --lib — passed on Windows with Go 1.27.1;
• git diff --check — passed;
• manual Windows smoke test of the read-only Codex commands — passed;
• cargo fmt --all -- --check — currently fails on pre-existing formatting differences in upstream main (including unrelated files); no unrelated formatting changes were included in this PR.

The rebase onto current upstream main preserved the upstream Codex module split and current Tauri dependency changes. The PR branch is now based on deacbe44 and has no merge conflicts.

[agent-sije70cmyk]

Closing this PR because the CLI work is being restarted in a dedicated fork (cockpit-tools-cli) with a revised core boundary. The implementation will be re-evaluated and selectively carried forward rather than continued on this branch.