fix(server): renew active managed Codex turns through native auth#21787

fix(server): preserve managed Codex provider identity across sign-ins

fix(server): renew active managed Codex sessions through native auth

test(server): cover native Codex token helper and catalog races