feat(codex): explicit ChatGPT-subscription vs API-key sign-in choice (#109)

Selecting the OpenAI provider in `openscience keys add` now presents an
explicit choice — 'ChatGPT subscription (Codex)' (the OAuth flow, no API
key) vs 'OpenAI Platform API key' — instead of dropping straight into the
API-key prompt with the Codex option only discoverable as a separate
pinned list item. Users who look under 'OpenAI' now find the subscription
path too.

Extracts a shared runCodexAuthFlow() helper so `keys add` (ChatGPT
branch) and `keys signin` reach the exact same OAuth flow, removing the
duplicated plugin-lookup + handlePluginAuth wiring.