Codex: classify rate limits and reload isolated auth

[editnori]

This is stacked on #29; once that context-overflow patch lands, the remaining diff is this commit.

Codex rate-limit events currently enter the generic live-start retry loop. The proxy retries them ten times, then returns HTTP 502 api_error, and Claude Code starts its own server-error retries. A profile that has already hit its limit therefore resends the same request for minutes.

This change:

• exits immediately when a Codex rate-limit event arrives before stream output
• returns HTTP 429 rate_limit_error with Retry-After for ordinary quota exhaustion
• if the translated input estimate is at or above the documented 372K Codex window, returns HTTP 413 request_too_large instead, so Claude Code trims an oversized compact/resume request
• reloads Codex auth from the isolated CCP_CONFIG_DIR file on each request, allowing an external lease owner to atomically rotate or switch the access-only profile without restarting the proxy
• preserves the existing cache behavior for normal non-isolated/keychain use

Validation:

• cargo fmt --check
• git diff --check
• full serial Cargo suite: 447 passed
• focused Codex unit tests: 157 passed
• smoke_cutover: 19 passed, including normal 429 and oversized 413 WebSocket cases

Strict all-target clippy still reports the same unrelated baseline warnings present before this diff.