fix(oauth): retire callback connections across repeated logins

[lidge-jun]

Summary

• Close every OAuth callback-listener response connection, including non-callback 404s, so a pooled socket cannot deliver a subsequent login to a retired flow. State validation, callback response status, and graceful listener shutdown are preserved.
• Carries fix(oauth): end the callback connection with its response #4280 at 1f826d92c7205f31ce174bbd987c04b2b08f7da4. The regression scenarios use explicit readiness and cleanup; three OAuth structure owners document the invariant.
• Includes the docs-first accounts roadmap checkpoint. The product change in this PR is callback-only; pool, quota-history and native-main plans remain pending. Independent PR against dev; no native stack and no merge requested.

Verification

• Local product tests, focused tests, builds, typecheck and install: NOT RUN, per explicit maintainer instruction. Hosted CI follows this PR's exact final head.
• git diff --check origin/dev...HEAD — passed (whitespace only).
• Independent plan audit: PASS; independent implementation/security source audit in progress. Hosted regression/CI results will be recorded after they finish.
• Added sequential fixed-port login, held-exchange/favicon, malformed callback and provider-error coverage. Runtime effectiveness is not claimed before hosted execution.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: luvs01 27862058+luvs01@users.noreply.github.com

Maintainer integration decision

Coordinator integrates reviewed head fa4226a9baf6bd90fcc7f5ef2ac57527604b42f9 into dev under the owner's explicit no-local-suite and trailing final-tip CI instruction. Independent current carry implementation/security reviewer Leibniz returned PASS on 96041e7..fa4226a with no material findings. Coordinator inspected every callback runtime change: all callback/404 responses close the connection; state validation, flow consumption and graceful shutdown remain unchanged. The four authored lifecycle/error regressions await CI. No open review threads or maintainer change requests at intake; luvs01 attribution preserved.

Final-tip hosted run https://github.com/lidge-jun/opencodex/actions/runs/34673984380 remains queued/in progress, not claimed passed. All local suites/build/typecheck/install NOT RUN. No real login, credential use or service restart was performed. Trailing failures remain a repair obligation. This is a maintainer integration decision, not a self-approval or a runtime success claim.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T04:59:09.848920Z	fa4226a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.