fix(oauth): use Codex CLI simplified flow URL (codex_cli_simplified_flow + id_token_add_organizations, drop prompt=consent) to avoid add-phone wall on fresh accounts
fix(oauth): warm chatgpt.com session (cf wait + nextauth refresh) before personal workspace getOrCreate in stage-2, so fresh OAuth accounts populate workspaces[] and obtain a token