Make stored account activation transactional

[cbusillo]

Summary

• split stored-account auth materialization from the durable active-account commit
• roll back auth.json and active account metadata if activation cannot complete
• make /login stored-account switching prepare credentials under a rollback guard and defer active-account metadata until the replacement session starts
• add regression coverage for side-effect-free auth derivation and rollback preserving stored accounts

Refs #160

Validation

• just fmt
• just test -p codex-login auth_accounts
• just test -p codex-tui login_slash_command_stored_account_selection_switches_account
• just fix -p codex-login
• just fix -p codex-tui (scoped; unrelated auto-fix churn reverted)
• cargo insta pending-snapshots --manifest-path tui/Cargo.toml
• JetBrains inspect-closeout --scope changed_files: green, 0 actionable findings

Notes

just fmt currently prints existing exclude-newer = "7 days" TOML parse warnings from Python formatter discovery, but completed and ran Rustfmt.