fix: make Codex and Claude Code subscriptions discoverable

[benfavre]

Codex and Claude Code already reuse their CLI login, but Settings presented them without a subscription setup path. Users can now choose clearly labeled subscription CLI options and see shared sign-in, copy-command, account-status and official-guide controls in Settings and the Agents empty state. API-key inputs remain specific to the independent API backends; the guide explains CLI credential precedence and the separate login required on an SSH target.

Verified the actual ShellDeck client paths with Codex 0.159.2 signed in through ChatGPT and Claude Code 2.1.285 signed in through Claude.ai/Max. A new opt-in live smoke removes API-key variables in a child process, confirms the subscription authentication methods, and receives the exact connection-test response from both providers. No user login was replaced or API key stored.

Validation:

• 853 normal workspace tests passed; the new subscription smoke passed separately (two real minimal completions).
• Linux check/build, Clippy with --no-deps -- -D warnings, formatting and whitespace checks passed.
• Native X11 checks at 1200 × 850 and 580 × 600: complete backend labels, CLI setup with no API-key input, exact clipboard commands, scrolling and shared Agents guidance.
• Verification record and five screenshots.

SDTEST-1935 stays opt-in outside CI. SDTEST-1936 tracks missing automated native render/click coverage. Fresh browser login, remote subscription authentication and full write-capable coding-agent journeys were not live-tested.