fix(auth): derive OpenAI token expiry from JWT exp on import (root cause of onboarding re-login)

The Codex CLI auth.json does not persist an expires_at, so imported OpenAI
credentials had expires_at=None. With no expiry, jcode never proactively
refreshed the access token and sent a stale/expired token on the very first
request, triggering a 401 'token refresh needed' and forcing the freshly
onboarded user to log in again. We now recover the expiry from the access
token's JWT exp claim so the proactive refresh fires before the first request.
The reactive 401-refresh remains as a safety net.