Migrate OAuth flow to PKCE

[amurph491]

Summary

• replace client-secret OAuth with Authorization Code + PKCE (S256)
• refresh tokens with team-owned client IDs and explicit auth_flow settings
• resolve the Codex PreToolUse hook through the installed ${PLUGIN_ROOT} instead of a cwd fallback
• keep OAuth tokens out of captured stdout and use secure-at-creation settings files with a private managed-workspace handoff
• add legacy migration guidance, documentation updates, and synchronized 1.9.0 manifests
• add PKCE, callback, hook, rotation, path-resolution, permission, and runtime regression coverage

Testing

• PYTHONDONTWRITEBYTECODE=1 python3 tests/test-oauth-pkce.py — 18 passed
• bash tests/test-check-token.sh — 50 passed
• bash tests/test-pkce-runtime-guard.sh
• git diff --check
• reinstalled local cachebuster build and verified the installed hook with CODEX_PLUGIN_ROOT and CLAUDE_PLUGIN_ROOT unset

Manual follow-up

• run the credentialed multi-platform end-to-end matrix with team-owned Spotify test applications
• reauthorize/rotate any refresh token exposed during pre-fix testing