g2: add Codex ask-mode approval UI

[MKV21]

Summary

Adds the G2/Web, simulator, and glasses UI for Codex Ask Mode permission requests from the daemon bridge. Sessions that enter awaiting_approval now show the original user prompt, an inline approval card, disabled normal input, and explicit resolution notices for approve, reject, and abort.

This also includes a development-only Vite bridge bootstrap via VITE_OPENVIDE_DEV_HOST_*. It is intended to make local browser/simulator/glasses testing repeatable without re-entering the same bridge host and pairing token after each reload, and is disabled in production builds.

This is stacked on #8 and expects the daemon-side pendingPermission state from that PR.

Changes

• apps/g2/src/screens/chat.tsx — renders Codex permission requests inline with the chat flow, preserves the prompt above the approval card, disables normal input while approval is pending, and keeps approval/reject/abort notices in the right order.
• apps/g2/src/screens/settings.tsx and apps/g2/src/glass/screens/settings.ts — add a Codex permission mode setting (Auto / Ask) for new Codex sessions.
• apps/g2/src/hooks/use-create-session.ts, apps/g2/src/screens/tool-picker.tsx, and the glasses session create/open paths — pass permissionMode: "ask" for new or imported Codex sessions when the setting is enabled.
• apps/g2/src/glass/OpenVideGlasses.tsx — keeps glasses session state synchronized with optimistic permission decisions, rolls back failed permission RPCs, avoids repeated display refreshes from unchanged polling data, and resubscribes without briefly clearing the session view.
• apps/g2/src/glass/screens/live-output.ts — shows permission request details and terminal approval outcomes on the glasses display without duplicate headings, stale processing text, or duplicated Codex assistant deltas.
• apps/g2/src/domain/output-parser.ts and apps/g2/src/domain/native-history.ts — parse Codex app-server message/tool events into stable chat output and replace assistant message deltas with final messages without dropping interleaved tool output.
• apps/g2/src/hooks/use-session-stream.ts and apps/g2/src/hooks/use-sessions.ts — make bridge stream subscription and session polling robust across reloads, reconnects, and background polling.
• apps/g2/src/contexts/bridge.tsx — supports an optional development-only bridge bootstrap from local Vite environment variables without overriding an existing active host selection.

Test plan

• ./node_modules/.bin/tsc -p apps/g2/tsconfig.json
• npm --workspace @openvide/g2 run build
• npm test --workspace @openvide/daemon
• Parser smoke: Codex agent_message delta/final replacement preserves interleaved tool lines and interleaved message IDs.
• Manual: G2 Web against a VPS bridge, Codex Ask Mode approve_once resumes the turn and shows the final Done. message.
• Manual: G2 Web reject and abort paths show terminal notices in the correct chat order without endless thinking text.
• Manual: reload while awaiting_approval restores the approval UI from daemon state and approve_once still resumes the turn.
• Manual: Even/G2 simulator glasses flow shows approval actions, read mode, approve/reject/abort outcomes, and returns to the final session output.
• Manual: hardware Even Realities G2 glasses test against the VPS bridge; approval flow, read mode, terminal output, and session-view stability were verified on the real glasses.
• Manual: Codex permission mode setting can be enabled for new G2/Web and glasses-created Codex sessions; directly imported native Codex sessions also inherit the setting when opened through G2.
• Code review: Claude Code reviewed the stacked PR daemon: add Codex ask-mode permission backend #8/g2: add Codex ask-mode approval UI #9 changes; follow-up findings were addressed in this PR.

Notes

• This PR is UI/simulator/glasses only; daemon backend support lives in daemon: add Codex ask-mode permission backend #8.
• Existing behavior remains the default: Codex permission mode is Auto unless the user enables Ask in G2 settings.
• The development bridge bootstrap is intentionally dev/test infrastructure for local simulator and glasses work. It reads only local environment variables and does not include host URLs or tokens in source.
• Known Vite warnings remain unchanged: even-toolkit dynamic/static import warning and the existing large chunk warning.

---

AI disclosure

Parts of this change were drafted by Codex (AI coder) and reviewed by Claude Code (AI reviewer). A human (@MKV21) reviewed, tested in the browser, simulator, and on hardware Even Realities G2 glasses, and approved the final result before submission.