[codex] fix Cline auth and Claude stream blocks

[LeenHawk]

What changed

• Classify Cline credentials as API keys instead of OAuth tokens, matching OpenCode Go/Zen behavior.
• Mirror the Cline device token into api_key and migrate existing Cline oauth_tokens credentials.
• Give Claude-compatible thinking and text blocks distinct sequential indexes and emit matched block-stop events.
• Add Rust and Console regression coverage.

Why

Cline API keys were incorrectly routed through the OAuth refresh path, even though they do not require a refresh token. Separately, Claude-compatible streams reused content block index 0 when transitioning from thinking to text, which could make the VS Code Claude plugin report content_block_delta mismatched and stop after the thinking block.

Impact

Existing Cline credentials are migrated automatically. Claude-compatible streaming clients now receive a valid content-block lifecycle across thinking and text output.

Validation

• gproxy: 798 tests passed
• gproxy-transform: 101 tests passed
• Console channel-meta.test.ts: 9 tests passed
• Streaming probe verified thinking index 0, text index 1, paired stops, and message_stop