fix: preserve active account on add with OAuth command regression tests

[Jeakcey]

Problem and behavior

With account A active, completing Add Account → ChatGPT Login for account B immediately activates B and overwrites the Codex auth.json. Users who only want to save another account unexpectedly lose their current selection.

OAuth completion now saves the account and preserves the existing active account, live authentication file, and usage timestamps. A first account also remains inactive until the user explicitly selects Switch. This keeps the existing guarded switch flow responsible for activation.

Fixes #140.

Relationship to #141 and attribution

This is an enhanced alternative to #141, based on current main (25816fe). It includes @legibet's original fix from ec371e1691fe3b5188db336294e80495cc0fbb6b, cherry-picked with the original author attribution preserved. The follow-up commit adds command-level regression coverage beyond the storage-level test in #141.

If maintainers prefer to merge #141, the follow-up test commit can be taken separately; the original fix is credited to @legibet.

Added regression coverage

Four async tests feed synthetic OAuth results into the real complete_login command and exercise real account persistence:

• Adding B preserves active A, byte-for-byte live auth.json contents (including newer session tokens), A's saved record, and B's inactive/never-used state.
• Adding the first account leaves no active account and does not create auth.json.
• Adding with saved accounts but no active account preserves that state and any externally managed live authentication file.
• Duplicate account names and OAuth failures leave both account storage and live authentication unchanged.

Test-only, thread-local temporary homes isolate both .codex-switcher and .codex. Filesystem access without a fixture fails in unit-test builds instead of falling back to real user files. Tests use a current-thread runtime and serialize access to the pending OAuth slot. Production path resolution is unchanged. No new dependencies are needed.

The functional change covers OAuth completion and the shared single-account add path. Bulk import behavior is outside this change.

Validation

On Windows:

• Before applying the fix, the command regression suite failed in all three successful-add scenarios (3 failed, 1 passed).
• cargo test --manifest-path src-tauri/Cargo.toml --offline: 54 passed.
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets --offline: completed with existing warnings in unrelated code.
• pnpm build: passed.
• pnpm test:reset-credits: 3 passed.
• pnpm test:desktop-reopen: 7 passed.
• git diff --check: passed.

OAuth results are synthetic; these tests do not perform a browser login, contact OAuth services, or stop running applications.