Expose browser-login progress phases and durable auth logging

[joshka-oai]

Problem

When browser login fails, Codex has historically exposed too little of the flow to make OAuth failures
understandable. Users mostly saw a static startup line and a final generic error, while support had to infer
where the flow broke from sparse logs. That is especially painful for transport/proxy failures around token
exchange, where the OAuth mechanics are already hard to reason about.

What This Delivers

This adds a shared login progress model for the browser OAuth flow, renders a small set of user-facing CLI
milestones, and classifies failures by stage and category so the terminal output is easier to understand.
It also adds durable tracing for the same milestones and preserves more non-secret provider/token-endpoint
context in codex-login.log.

Mental Model

codex-login owns structured flow state: phase, failure phase, and failure category. The CLI consumes that
state, prints only the milestones that matter to a user, and suppresses the generic fallback error when a
structured failure was already shown. Token-exchange errors keep the useful lower-level reqwest detail, but
strip the attached URL and log a sanitized endpoint separately.

Non-Goals

This does not migrate the flow to openidconnect, replace tiny_http with axum, or wire TUI/app-server
onto the progress stream yet.

Tradeoffs

The default user-facing strings now live in the login crate with the flow vocabulary. That makes the CLI path
simple and keeps the snapshot coverage close to the state model, but it does mean LoginPhase carries one
default presentation via Display plus a separate is_user_visible() filter.

Observability

The callback path still avoids logging raw authorization codes, device codes, tokens, or raw callback query
strings. It does now log provider error_description and token-endpoint error detail, and it records startup
and completion milestones that were previously only visible through the live progress stream.

Tests

• cargo test -p codex-login
• cargo test -p codex-cli --lib
• just fmt
• cargo clippy --fix --tests --allow-dirty --allow-no-vcs -p codex-login -p codex-cli

[joshka-oai]

Closing for another simpler approach on this