[codex] add interactive provider login

[wusuiling-if]

What changed

• add mca login and mca logout with an interactive provider selector
• accept API keys through hidden terminal input and store them in the private per-user env file
• prompt for missing credentials during interactive agent startup
• preserve environment variables and --env-file for CI, scripts, and custom endpoints
• update provider errors and setup documentation

Why

Provider setup previously required users to create an env template, locate it in a platform-specific directory, and edit it manually. Credential management should be available directly from the CLI, similar to other coding agents.

Security and compatibility

• credential files remain owner-only (0600 on POSIX)
• reads reject symlinks, non-regular files, foreign ownership, and broad permissions
• updates use a same-directory temporary file plus atomic replacement
• repeated provider entries are deduplicated and logout removes stored secret values
• prompted keys are passed directly to model construction without leaking into process environment state

Validation

• PYTHONPATH=src python3 -m pytest -q: 334 passed, 2 skipped
• real TTY smoke test confirmed hidden input, 0600 storage, and secret removal after logout
• PYTHONPATH=src python3 -m compileall -q src tests