feat(accounts): support explicit access-token-only credential imports

[yjx-git001]

Summary

Please support importing a valid access-token-only Codex credential when explicit account metadata is supplied, while clearly marking the account as non-refreshable.

This is useful when migrating credentials from an account manager/export that provides a currently valid ChatGPT/Codex access token but does not provide an ID token or refresh token.

Current behavior

Current main defines all three fields as required strings in AuthTokens:

id_token: str
access_token: str
refresh_token: str

claims_from_auth() also derives email, plan, workspace, and account identity only from the ID token. As a result, both single and batch account import reject an otherwise usable access token before the account can be created, even if the source export includes explicit email/account/plan metadata.

The existing batch import endpoint from #159 handles multiple complete auth files, but it does not address access-token-only credentials.

Requested behavior

Add an explicit, safe import shape for access-token-only accounts:

• Require accessToken.
• Allow refreshToken and idToken to be absent.
• When the ID token is absent, accept explicit metadata such as email, accountId, planType, workspaceId, and workspaceLabel from the import payload.
• Store missing refresh/ID token fields as missing/null, without generating placeholder credentials.
• Mark the account as non-refreshable in the dashboard/auth status.
• Allow normal use and usage probing while the access token remains valid.
• On token expiry or a permanent upstream 401, transition the account to reauth_required instead of attempting an impossible refresh loop.
• Apply the same parsing rules to single and batch imports.

Why this is useful

A local compatibility patch implementing this behavior has been used successfully across 1.21.0-beta.3, 1.21.0-beta.4, and 1.21.0. Every image upgrade recreates the container and requires the patch to be reapplied because the native import schema still rejects the credential shape.

Supporting the shape upstream would remove a recurring operational patch while keeping the limitation explicit: these accounts work only until their access tokens expire and cannot be refreshed automatically.

Security / correctness constraints

• Do not infer identity from the access token unless the relevant claims are actually present and validated.
• Do not silently default unknown plans when explicit metadata is available.
• Do not log or return raw token material in validation errors.
• Prefer an explicit opt-in import schema or field over loosening validation ambiguously for every malformed auth file.

Related work

• feat(accounts): support batch auth import/export and optional proxy key hardening #159 added batch auth import/export for complete auth files.
• This request concerns credential completeness and lifecycle behavior, not array/file batching.