[codex] add oauth gitlab backend

[aksOps]

Summary

• Add OAuth authorization-code + PKCE support for GitLab auth, including loopback callback handling, state validation, token exchange, refresh, and owner-only local secret persistence on Unix.
• Keep GitLab as the source of truth for issues, labels, notes, and board state by removing startup auto-sync and local sidecar board-state persistence.
• Add GitLab metadata fields, backend job error mapping, and TUI parity refinements, plus a screenshot capture example for review artifacts.

Impact

Users can authenticate with GitLab OAuth instead of only PATs. PAT auth still works. Local storage is now limited to config/secrets; board data is read from and written to GitLab through explicit actions.

Validation

• cargo test -> 294 passed
• cargo fmt -- --check -> clean
• cargo clippy --all-targets --all-features -> 0 errors, 5 existing warnings
• git diff --cached --check -> clean before commit

Notes

Live OAuth/GitLab integration still needs a disposable GitLab project and OAuth app configured with http://127.0.0.1:8910/oauth/callback.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​sha2@​0.11.0

View full report

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.6% Duplication on New Code

See analysis details on SonarQube Cloud