feat(llm, config, cli): Add ChatGPT subscription auth for OpenAI

[JeanMertz]

A ChatGPT Plus or Pro subscription can now serve a turn. jp provider llm auth login openai stores the credential; an auth chain decides which
credential a request bills to, falling through to the next when one is
spent.

Auth chain entries name a kind and a credential: api_key, api_key:work,
subscription, subscription:personal, or a bare name resolved against
both. api and sub are accepted for the kinds. api_key_env takes a map
as well as a string, so a provider can hold several named keys, and every
provider has a chain rather than only the two selling a subscription.

Subscription requests reach ChatGPT's Codex host, which accepts a narrower
request than the platform API: the system prompt moves into instructions,
seven parameters it rejects are dropped, and explicit cache breakpoints are
removed. It answers a 200 carrying an event stream with no content type,
which the client now reads. When a plan's usage window is spent, JP redeems
one of the account's reset credits before falling through to per-token
billing.

Credential commands move from jp provider auth to jp provider llm auth,
so a provider is named plainly rather than by category, and --profile
becomes --name. auth list covers every provider, marks a fault in
place, and reports an expiry as a duration; its JSON payload carries values
rather than the table's prose.

A provider billed two ways records each scenario twice, and the two
recordings are compared: what JP sent, and what JP recorded. Neither
comparison includes the model's wording, its chosen tool arguments, its
reasoning, or the ids the host mints. Normalizing a wire dialect is the
provider's own job, and the default panics rather than passing the body
through, so a provider gaining a second route fails until it supplies a
projection.

Signed-off-by: Jean Mertz git@jeanmertz.com