Expose RFC 8628 verification_uri_complete for ChatGPT device-code login

What variant of Codex are you using?

Codex App Server and CLI device authentication.

What feature would you like to see?

Codex App Server currently returns separate verificationUrl and userCode values for
account/login/start with type: "chatgptDeviceCode". This is correct, but browser-based
clients controlling Codex on a remote private machine must ask the user to copy and paste the
code into the OpenAI page.

Could the device authorization response expose RFC 8628's optional
verification_uri_complete value and surface it through App Server as an optional,
backward-compatible field such as verificationUrlComplete?

The CLI could also print this complete URL when available.

Desired flow

1. The client starts chatgptDeviceCode login.
2. The client opens verificationUrlComplete in the user's browser.
3. OpenAI shows the account and device confirmation UI with the code already associated.
4. The existing login-completed notification finishes the flow.

No access token, refresh token, or credential file needs to pass through the browser-based
client. Existing verificationUrl and userCode fields remain unchanged as a fallback.

Why

This removes the hardest step for non-technical users while preserving the device-code security
model and the existing remote/headless login architecture. RFC 8628 section 3.3.1 defines this
optimization and recommends that the authorization page still show the code and ask the user to
confirm the device.

Additional information

• Current App Server flow: https://github.com/openai/codex/blob/main/codex-rs/app-server/README.md#account-endpoints
• RFC 8628: https://www.rfc-editor.org/rfc/rfc8628.html#section-3.3.1

Start with the account endpoints section in codex-rs/app-server/README.md and trace the account/login/start flow for type chatgptDeviceCode. Read RFC 8628 section 3.3.1, then identify where verificationUrl and userCode are produced and surfaced to the CLI. Done means an optional verificationUrlComplete is exposed without changing existing fields, and the CLI prints it when available.