[Ticket]: Codex / ChatGPT custom-model-provider OAuth2 integration with our gateway

### Type
Feature

### Summary
We need Codex/ChatGPT users to be able to complete an OAuth2 flow against our issuer (Keycloak) to obtain API keys, then talk to our OpenAI-compatible gateway as a custom model provider. Expected result: a Codex user can configure our gateway as a custom model provider via OAuth2, without manually copying static API keys.

### Intent
Let Codex users authenticate the same way our other agent clients do (real OAuth2 against our issuer), rather than relying on manually-issued static keys, consistent with this repo's Keycloak-JWT-is-the-boundary model (ADR-0021).

### Source of truth (links)
https://learn.chatgpt.com/docs/config-file/config-advanced#custom-model-providers
Sprint planning session, 2026-07-11 (local planning doc — no public source-of-truth link yet).

### Current Behavior
N/A — new integration. Gateway currently authenticates via Keycloak JWT (ADR-0021); no documented Codex-specific OAuth2 client/flow exists yet.

### Expected Behavior
A Codex user configures our gateway as a custom model provider per the linked ChatGPT docs, completes an OAuth2 flow against our Keycloak issuer, and can make authenticated requests to our OpenAI-compatible endpoints.

### Acceptance Criteria
- [ ] Given the ChatGPT custom-model-provider config format, when our gateway + Keycloak are configured to match it, then a Codex user can complete the OAuth2 flow.
- [ ] Given a completed flow, when the user sends a request via Codex, then it's authenticated and routed the same as any other Keycloak-authenticated client.
- [ ] Verification evidence is provided (see below).

### Out of Scope
The Claude Code plugin (tracked as a separate ticket) — this ticket is Codex/ChatGPT-specific.

### Technical Context
Keycloak realm/client config: `charts/keycloak-baseline`. Gateway auth boundary: ADR-0021 (`docs/adr/0021-*.md`). Will likely need a new Keycloak client registration matching the custom-model-provider OAuth2 config shape from the linked doc.

### Test Plan
TBD by ticket owner — configure Codex per the linked doc against a test Keycloak client, confirm end-to-end auth + a successful chat completion.

### Verification evidence
N/A — not yet implemented. To be filled in by the ticket owner on completion.

### Human accountable owner
TBD — to be assigned during sprint planning.

### AI Usage Declaration
Drafting the ticket

### Human verification completed
(unchecked — pending assignment and human review)