Make Codex LB a managed CPTools provider

[Enjoyoer]

Summary

• expose CPTools Codex local access as the stable cockpit-codex-lb provider
• preserve existing third-party providers during OAuth switch while cleaning legacy managed provider ids
• pin the selected CPTools account into the managed LB route before launching Codex

Verification

• cargo test -p cockpit-tools codex_account::tests::api_key_config_toml_uses_fixed_provider_for_default_official_endpoint --lib
• cargo test -p cockpit-tools codex_local_access::tests::pins_preferred_account_to_front_without_dropping_fallbacks --lib
• cargo test -p cockpit-tools codex_local_access::tests::runtime_account_uses_cockpit_codex_lb_provider --lib
• cargo check -p cockpit-tools
• git diff --check