fix: preserve provider keys during live backfill

[Rat0323]

What changed

• keep archived Pure API auth.json credentials when the active provider editor refreshes from Codex live files
• keep the archived provider key for official mixed API profiles while still refreshing the current official login fields
• apply the same credential ownership rule to the automatic live-file snapshot that runs before switching providers
• add frontend and core regression coverage for login-time key changes

Why

Codex Desktop can rewrite ~/.codex/auth.json when a user signs in with an API key. Codex++ treated that runtime file as the source of truth for the active provider in two paths:

1. opening the active provider detail and saving it
2. snapshotting the active provider before switching to another provider

For a Pure API profile, this could replace the provider's archived third-party key with the key entered on the Codex login screen. The snapshot path meant the overwrite could happen even without opening the provider detail.

Behavior after this change

• Pure API: live non-credential config can still be backfilled, but the provider's archived auth/key wins
• Official mixed API: current official login fields remain live, OPENAI_API_KEY is removed from the auth snapshot, and the archived provider key wins in experimental_bearer_token
• Normal official login and external/manual migration behavior remain unchanged

Related context: #1204, #1531.

Validation

• npm test — 38 passed
• npm run check
• cargo test -p codex-plus-core --test relay_config — 109 passed
• cargo fmt --check