Add device-code ChatGPT auth for headless/remote projects

[Bnjoroge1]

This updates codex-acp so ChatGPT auth remains available when NO_BROWSER=1 instead of falling back to API-key-only auth.

What changed:

• use device-code auth for ChatGPT login in headless/remote mode
• advertise the headless path as a first-class terminal auth method
• add a dedicated /auth entrypoint for terminal-driven login
• tighten /auth arg parsing so it only matches the first positional subcommand slot

Behavior:

• local/browser-capable projects keep the existing browser callback flow
• headless/remote projects use terminal auth plus device-code login

Why:

• remote Zed projects currently lose ChatGPT subscription auth because codex-acp removes that auth path in NO_BROWSER mode
• upstream Codex already supports device-code auth, so this wires the adapter into that existing flow

Validated with:

• cargo check
• cargo test --quiet
• i've been using it in a locally built binary in my remote ssh setup for an Ubuntu 25.10 machine.