fix: preserve rotated auth tokens when switching accounts

[serg-shcherbak]

Summary

Prevents ChatGPT logout after switching from account A to B and back. ChatGPT can rotate a refresh token while an account is active; before replacing ~/.codex/auth.json, the switcher now saves the matching live token set and serializes authentication changes so a late refresh cannot restore the wrong account.

Scope

This is intentionally limited to credential persistence and authentication-operation ordering. It does not add a background refresh loop, re-authentication UI, app restart behavior, localization, or a general account-store worker.

Related work

• Related: fix: protect token rotation and account runtime state #122 — broader auth-state, re-authentication, and switch/reopen handling.
• Related: fix: serialize account store updates #118 — general single-writer account-store serialization.
• Related: Sync stored accounts with live Codex auth #32 — periodic live-auth reconciliation.

Test plan

• cargo test --manifest-path src-tauri/Cargo.toml — 37 passed.
• pnpm build.
• Repeated A → B → A switching in a local macOS build; opening chats stayed signed in.

[Jeakcey]

I reproduced the Windows sign-in regression described in #129 and found one additional path beyond this PR: the stored ID token can be expired while the access token remains valid, so the current access-only freshness check skips refresh before switching.

I opened stacked follow-up #134 on top of this branch. It preserves all commits and authorship from #128 and adds one commit that:

• checks both ID and access token expiry;
• refreshes the target before writing auth.json;
• persists a rotated refresh token even when the refresh response lacks a usable ID token;
• serializes rapid tray selections; and
• adds deterministic synthetic-JWT regression tests.

Local checks: 39 Rust tests passed, Clippy completed with only existing base warnings, pnpm build passed, and the Windows no-bundle release build passed.

If you prefer to keep #128 as the primary PR, the follow-up commit is daac4b6 and can be cherry-picked onto this branch.