Bring MCP OAuth callback pages in line with the existing Codex login UX

Start in codex-rs/rmcp-client/src/perform_oauth_login.rs and inspect the current success, provider-error, and invalid-callback responses. Compare the existing login UX described in #20136 and #12289, then cover light, dark, narrow-window, escaping, and security-header requirements without changing OAuth behavior. Add snapshot coverage for each user-visible state and run the focused codex-rmcp-client tests.

What variant of Codex are you using?

Codex App, IDE extension, and CLI flows that authenticate remote MCP servers through codex-rmcp-client.

What feature would you like to see?

The local MCP OAuth callback currently renders browser-default plain text. On success it shows:

Authentication complete. You may close this window.

Provider errors and invalid callbacks are similarly returned as unstyled text. This feels inconsistent with the regular ChatGPT login callback, which already has branded, theme-aware success and error pages.

Please bring the MCP OAuth callback pages into parity with the existing Codex login UX:

• Render self-contained HTML for success, provider-error, and invalid-callback states.
• Support light and dark color schemes and narrow/mobile browser windows.
• Give common provider failures such as access_denied and invalid_scope clear user-facing copy.
• Keep raw provider error details available in a secondary/collapsible section.
• HTML-escape all provider-supplied values.
• Return appropriate content type, no-cache, referrer, MIME-sniffing, and CSP headers.
• Include snapshot coverage for the user-visible states.

The relevant callback responses are currently produced in:

codex-rs/rmcp-client/src/perform_oauth_login.rs

There is strong existing precedent in the main login flow:

• #20136 updated the localhost login success page to match the Codex desktop auth UX.
• #12289 replaced generic/plain login failures with a branded, actionable error page.

Additional information

This request is presentation-only and should not change OAuth discovery, requested scopes, callback validation, or token exchange behavior.

The underlying invalid_scope behavior is tracked separately in #23242. Issue #33151 also shows the exact current success text, but tracks a post-callback 403 rather than the callback page appearance.

A focused implementation can remain inside codex-rmcp-client: embed a static template, render the three callback states, add response security headers, and cover the rendered HTML with snapshots.