feat: sync active providers to SSH remotes

[hezhexi2002]

Summary

• add opt-in SSH synchronization for the active provider, with automatic sync after a provider switch and an explicit Sync now action
• preserve unrelated remote Codex project, plugin, MCP, and feature configuration while replacing only provider routing and authentication
• support both official ChatGPT login profiles and Responses-compatible API profiles
• stop a managed remote app-server after a successful switch so Codex can reconnect with the new provider

Security and recovery

• require non-interactive OpenSSH authentication and validate the SSH target and remote CODEX_HOME
• send config.toml and auth.json only through SSH standard input; credentials are never placed in command-line arguments or local staging files
• stage remote files with 0600 permissions, back up the previous files under the remote CODEX_HOME, and roll back both files if apply or app-server shutdown fails
• keep the feature disabled by default and surface a trusted-host warning in the UI and documentation

Validation

• cargo test -p codex-plus-core remote_relay_sync --lib (6 passed)
• cargo check -p codex-plus-manager
• cargo clippy -p codex-plus-core -p codex-plus-manager --all-targets (passed with existing warnings)
• npm run check
• npm run vite:build
• node --experimental-strip-types --test "src/*.test.ts" (47 passed)
• changed Rust files pass rustfmt --check; git diff --check passes
• live macOS-to-Linux SSH validation confirmed provider routing, 0600 permissions, backup creation, preserved remote configuration, and managed app-server shutdown/reconnect behavior

Existing test-suite issues observed locally

• the full workspace run completed with 201 passed and 11 failures in existing proxy, VLM mock, and shared-path tests; the new remote-sync tests all passed
• the repository's exact npm test command does not enable Node's TypeScript stripping on Node 22.17, while the equivalent command above passes all 47 tests
• the i18n verifier reports pre-existing missing/stale DreamSkin, Sub2API, and provider-index entries; no missing entry belongs to this change

[BigPizzaV3]

远端 app-server 停止逻辑有一个阻塞性的进程安全问题。

脚本读取 $codex_home/app-server-control/app-server.pid 后，只要 kill -0 "$pid" 成功，就会枚举其后代并对整棵进程树发送 kill。PID 文件可能因为崩溃、机器重启后的残留或 PID 复用而指向完全无关的远端进程；当前没有校验该 PID 的可执行文件、命令行、启动时间或控制 socket 归属。启用“切换后自动同步”时，这可能在一次普通供应商切换中终止用户的其他服务。

请在终止前验证 PID 确实属于 Codex app-server（例如核对可执行文件/命令行和该 CODEX_HOME 的控制参数，并对无法验证的平台选择不终止而提示用户），同时补“过期 PID 指向无关进程时不得 kill”的测试。分支目前也与最新 main 冲突，修复后需要 rebase 并重新跑全平台 CI。