feat(ai): migrate ChatGPT authentication and inference - #291

Summary

Register Diffex ChatGPT sessions and use account-specific models through the public Responses API.

Reasoning

Authentication, granted plan usage, model discovery, inference, and sign-out must share the same issued registration.
Transient failures should preserve usable credentials; terminal refresh failures require explicit sign-in.

Changes

• Persist stable host identities and issued registrations; validate sign-in tokens and consent.
• Support saved registration selection and remote callback completion.
• Fetch account-specific catalogs with isolated caches and report subscription usage.
• Use public streaming Responses requests with storage disabled.
• Coordinate cancellation, credential writes, token expiry, and logout revocation.
• Share credential reloads across active storage paths without retaining inactive credentials.
• Use private test directories, owner-only credential writes, and persistent example storage under the user's home.
• Pin the token-validation dependency and refresh associated lockfiles.

Testing

• npm run check and ./test.sh passed on the complete local revision.
• Controlled OAuth, registration, model-cache, inference, credential synchronization, and logout tests passed.
• Registration path traversal and credential permission regressions passed.
• Validation used synthetic credentials and mocked provider responses.