[codex] Report unusable MCP OAuth credentials as logged out

[anp-oai]

Why

Persisted MCP OAuth credentials were reported as authenticated whenever a credential record existed. An expired token without a usable refresh token could therefore appear as OAuth even though startup could not authenticate with it, leaving users with a misleading status instead of a login prompt.

What changed

• Classify stored OAuth credentials as missing, usable, or requiring authorization.
• Reuse the existing refresh window so near-expiry credentials without a refresh path are also treated as logged out.
• Validate required credential fields before reporting OAuth authentication.
• Add unit coverage for credential usability and integration coverage for expired, unexpired, and refreshable persisted credentials.

Validation

• just test -p codex-rmcp-client

[etraut-openai]

Change looks good.

I built locally and had Codex do a manual test with a mock MCP server and tested four cases: auth valid, no auth, refresh succeeds, refresh fails. All of them worked as expected.