feat(providers): support Codex OAuth pools with inherited routing defaults

* feat(auth): support named chatgpt oauth providers

- add provider-scoped ChatGPT OAuth routes and CLI support

- persist refresh tokens per provider and reject provider-type collisions

- wire provider OAuth setup flows in the dashboard and setup UI

Refs #448

* feat(agent): add chatgpt oauth account routing

- add agent other_config routing for manual and round-robin selection

- reuse routed provider resolution across resolver and pending loaders

- add router, parser, and agent advanced dialog coverage for multi-account use

Refs #448

* docs(api): describe chatgpt oauth routing

- document named-provider ChatGPT OAuth auth routes

- describe agent-side account routing and round-robin behavior

- update OpenAPI agent config schema and provider type enum

Refs #448

* fix(store): add missing agent key context helpers

* feat(ui): clarify chatgpt oauth account setup and routing

* docs(providers): align chatgpt oauth alias examples

* feat(agent): add codex pool activity dashboard

* fix(providers): harden codex oauth alias setup

* feat(codex-pool): improve routing dashboard UX

- redesign the Codex/OpenAI pool page around saved-pool checkpoints and live evidence

- add clearer selection, attention, and recent-proof states for pool members

- make the lower panels fill the remaining desktop viewport while staying responsive

* fix(store): resolve context helper merge duplication

* feat(oauth): add codex pool quota and observation APIs

- add quota inspection and observation endpoints for ChatGPT Subscription (OAuth) providers

- teach codex routing to surface pool activity, observation metadata, and quota-aware readiness

- extend tests and HTTP docs/OpenAPI for the new pool monitoring flows

* feat(web): add codex pool quota monitor and controls

- add provider quota fetching, readiness badges, and live routing evidence on the account pool page

- redesign pool setup and activity panels for multi-account management with localized copy updates

- keep the live monitor internally scrollable and compact the account cards for better viewport fit

* fix(web): clarify pool routing labels

- rename the recent request badge from Direct to Selected

- restore compact quota bars in the live pool cards

* feat(codex-pool): add runtime health dashboard

- derive per-provider success and failure health from routed Codex traces

- surface routing, quota, and recent request evidence in the pool UI

- align provider alias guidance and owner access with the dashboard role model

* docs(auth): document tenant scoping and key roles

* fix(auth): harden tenant and codex pool access control

* fix(providers): align codex pool runtime defaults

* feat(ui): tighten codex pool responsive layout

* feat(chatgpt-oauth): refine codex pool management UX

* feat(chatgpt-oauth): surface quota bars on provider pages

- add compact quota bars to Codex provider rows and provider detail

- fetch quota only for ready visible provider rows and ready detail aliases

- fix managed-member detail visibility and tighten provider locale copy

internal/http/api_key_cache_test.go

@@ -41,10 +41,12 @@ func (m *mockAPIKeyStore) TouchLastUsed(_ context.Context, id uuid.UUID) error {
 	return nil
 }
 
-func (m *mockAPIKeyStore) Create(_ context.Context, _ *store.APIKeyData) error            { return nil }
-func (m *mockAPIKeyStore) List(_ context.Context, _ string) ([]store.APIKeyData, error)   { return nil, nil }
-func (m *mockAPIKeyStore) Revoke(_ context.Context, _ uuid.UUID, _ string) error          { return nil }
-func (m *mockAPIKeyStore) Delete(_ context.Context, _ uuid.UUID, _ string) error          { return nil }
+func (m *mockAPIKeyStore) Create(_ context.Context, _ *store.APIKeyData) error { return nil }
+func (m *mockAPIKeyStore) List(_ context.Context, _ string) ([]store.APIKeyData, error) {
+	return nil, nil
+}
+func (m *mockAPIKeyStore) Revoke(_ context.Context, _ uuid.UUID, _ string) error { return nil }
+func (m *mockAPIKeyStore) Delete(_ context.Context, _ uuid.UUID, _ string) error { return nil }
 
 func (m *mockAPIKeyStore) getCalls() int {
 	m.mu.Lock()
@@ -192,9 +194,7 @@ func TestCacheConcurrentAccess(t *testing.T) {
 
 	var wg sync.WaitGroup
 	for range 50 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
+		wg.Go(func() {
 			key, role := c.getOrFetch(context.Background(), "concurrent")
 			if key == nil {
 				t.Error("expected key, got nil")
@@ -202,7 +202,7 @@ func TestCacheConcurrentAccess(t *testing.T) {
 			if role != permissions.RoleAdmin {
 				t.Errorf("role = %v, want admin", role)
 			}
-		}()
+		})
 	}
 	wg.Wait()