Make Codex OAuth callback port configurable or auto-select an available port instead of fixed localhost:1455

Codex currently appears to rely on a fixed local OAuth callback URL:

http://localhost:1455/auth/callback

This causes problems when multiple Codex-related clients are running at the same time, especially in Remote SSH / VSCode environments.

In my case, I was using the Codex VSCode extension on a remote server. The login flow opened the browser on my local Windows machine and redirected to:

http://localhost:1455/auth/callback?code=...

However, port 1455 on my local machine had already been occupied by another VSCode window / Codex instance. As a result, the callback was handled by the wrong process or failed entirely, and the remote Codex VSCode plugin could not complete login.

This is especially confusing because:

• Codex App and Codex VSCode extension cannot reliably run at the same time.
• Multiple VSCode windows can compete for the same 1455 callback port.
• In Remote SSH scenarios, users already need port forwarding from local localhost:1455 to remote localhost:1455, and fixed-port conflicts make this fragile.
• The error shown in the browser is just "This site can't be reached", which does not clearly indicate that the callback port is already occupied.

Expected behavior:
Codex should support one of the following:

1. Allow users to configure the OAuth callback port.
2. Automatically choose an available local callback port.
3. Use a device-code login flow for remote/headless environments.
4. Detect when port 1455 is already occupied and show a clear error message explaining which process/client is using it.

Actual behavior:
Codex appears to require localhost:1455. If another Codex App, VSCode window, or forwarded port already uses 1455, login fails.

Environment:

• Codex VSCode extension
• VSCode Remote SSH
• Remote server running Linux
• Local machine running Windows
• Login callback URL: http://localhost:1455/auth/callback