codex login --api-key shows misleading missing-value error instead of deprecation guidance

Summary

codex login --api-key currently fails at the Clap layer with a generic missing-value error, while codex login --help documents --with-api-key as the supported stdin-based flow.

That makes the UX confusing:

$ codex login --api-key
error: a value is required for '--api-key <API_KEY>' but none was supplied

But codex login --help says:

--with-api-key
    Read the API key from stdin (e.g. `printenv OPENAI_API_KEY | codex login --with-api-key`)

Expected behavior

Both of these should route the user to the same guidance:

• codex login --api-key
• codex login --api-key <value>

Instead of the generic Clap parse error, the CLI should print an explicit deprecation message telling the user to pipe the key via stdin with --with-api-key.

Repro

1. Run codex login --api-key
2. Observe the generic missing-value parse error
3. Run codex login --help
4. Observe that the documented API-key path is --with-api-key via stdin

Notes

I verified locally that the flag is still registered as a hidden deprecated option that takes a value, so Clap exits before Codex can emit its own deprecation guidance. I also have a local fix prepared that makes the deprecated flag accept zero or one value so both forms reach the intended guidance path.