[codex] Preserve auth email allowlist with domain

[time-attack]

Fixes #328.

What changed

• keep AUTH_ALLOWED_EMAILS optional when AUTH_ALLOWED_EMAIL_DOMAIN is configured, so the CLI still sends it to auth and portal
• make portal authorization accept an address matching either the explicit list or the configured domain, matching the auth broker
• cover optional secret routing and combined list/domain authorization with focused regressions

Root cause

The conditional secret specs had no optionalOtherwise, so a configured domain removed AUTH_ALLOWED_EMAILS from computedSecrets instead of making it optional. The portal also evaluated simultaneous list and domain rules as an intersection while the broker evaluated them as a union.

Validation

• node --test test/auth-broker.test.ts in cli (8 passed)
• node --test test/oidc.test.ts in plugins/portal (14 passed)
• npm run typecheck
• npm run lint
• Prettier check on changed files
• independent fresh-context review: no findings

Live dev-instance QA was attempted, but no Slack pool app became available during the launcher's bounded wait, so no live instance was created.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[time-attack]

The branch is mergeable, but GitHub currently shows only a skipped check. Before merging, please run the current CI matrix, complete live combined-domain/list authentication QA, and obtain the required fresh-context review. @16francej, are there any additional auth-policy cases you want covered?