fix: avoid invalidating valid Codex sessions during background refresh

[Bl0ck154]

Fixes the v0.2.12 OAuth regression reported in #136.

The main issue is that background usage/metadata refreshes can refresh OAuth solely because the stored ID token is expired, even while the access token and live Codex session are still valid. With rotated/single-use refresh tokens this can surface refresh_token_invalidated / refresh_token_reused and incorrectly make valid accounts look logged out.

Changes:

• background usage, warm-up and metadata refresh only refresh OAuth when the access token is actually expired/near expiry;
• account switching still prefers a full token refresh, but falls back to an existing usable access token if refresh fails, instead of aborting the switch;
• known refresh-token failures are mapped to human-readable messages instead of dumping raw backend JSON into the account card;
• when Codex is running, Switch now opens the existing force-close-and-switch flow instead of behaving like a dead/disabled action; the button label remains simply Switch.

Validation:

• frontend production build passes (tsc && vite build);
• Rust test suite passes: 49 passed, 0 failed.