feat: reconcile external Codex logins

[SilkageNet]

Summary

• derive the active account from Codex's live auth instead of stale switch state
• add sync, sync --check, sync --as, and sync --prefer-live recovery flows
• reconcile an already-live target without closing or restarting Codex
• make usage refresh and doctor follow the actual live profile
• document external-login, unmanaged-login, and credential-conflict behavior

Verification

• No real credentials or sensitive diagnostics are included
• pre-commit hooks passed
• go test -race ./...
• go vet ./...
• golangci-lint run ./...
• six release target cross-builds
• gitleaks and govulncheck
• User-visible and security changes are documented