fix: sync official login auth across same-account profiles

[Rat0323]

Problem

Each relay profile stores its own authContents snapshot. When the ChatGPT login refreshes, Codex++ only backfills the currently active profile before switching, so other official / official+API profiles keep stale tokens. Switching back to one of those profiles writes the stale auth into ~/.codex/auth.json, and Codex drops the login.

Change

Before saving a provider switch, sync the current live ChatGPT auth into official profiles that still belong to the same account:

• Only runs when live auth.json is a valid ChatGPT login.
• Only touches relayMode = official profiles (includes official+API mixes).
• Skips profiles whose auth clearly contains a different account label, preserving manually-bound provider accounts.
• Leaves pure API / aggregate profiles untouched.
• Strips OPENAI_API_KEY before storing, so mixed-API keys stay in the provider config rather than auth.

Tests

• cargo test -p codex-plus-core --test relay_switch
• cargo test -p codex-plus-core --test relay_config

Windows test note

This PR includes the same .gitattributes LF normalization for upstream theme assets as #1771, which is intended to keep the byte-exact theme asset checks green on Windows checkouts. The macOS x64 artifact job can fail transiently with hdiutil: create failed - Resource busy; that failure is unrelated to this change.

One open design question for maintainers: should authContents intentionally support a different official account per profile? This PR preserves that case when the account label differs; if per-account binding is not intended, this also fixes stale logins for the common single-account flow.