Add forced_chatgpt_workspace_id and forced_login_method configuration options (#5303)

This PR adds support for configs to specify a forced login method
(chatgpt or api) as well as a forced chatgpt account id. This lets
enterprises uses [managed
configs](https://developers.openai.com/codex/security#managed-configuration)
to force all employees to use their company's workspace instead of their
own or any other.

When a workspace id is set, a query param is sent to the login flow
which auto-selects the given workspace or errors if the user isn't a
member of it.

This PR is large but a large % of it is tests, wiring, and required
formatting changes.

API login with chatgpt forced
<img width="1592" height="116" alt="CleanShot 2025-10-19 at 22 40 04"
src="https://github.com/user-attachments/assets/560c6bb4-a20a-4a37-95af-93df39d057dd"
/>

ChatGPT login with api forced
<img width="1018" height="100" alt="CleanShot 2025-10-19 at 22 40 29"
src="https://github.com/user-attachments/assets/d010bbbb-9c8d-4227-9eda-e55bf043b4af"
/>

Onboarding with api forced
<img width="892" height="460" alt="CleanShot 2025-10-19 at 22 41 02"
src="https://github.com/user-attachments/assets/cc0ed45c-b257-4d62-a32e-6ca7514b5edd"
/>

Onboarding with ChatGPT forced
<img width="1154" height="426" alt="CleanShot 2025-10-19 at 22 41 27"
src="https://github.com/user-attachments/assets/41c41417-dc68-4bb4-b3e7-3b7769f7e6a1"
/>

Logging in with the wrong workspace
<img width="2222" height="84" alt="CleanShot 2025-10-19 at 22 42 31"
src="https://github.com/user-attachments/assets/0ff4222c-f626-4dd3-b035-0b7fe998a046"
/>

codex-rs/login/tests/suite/device_code_login.rs

@@ -97,7 +97,11 @@ async fn mock_oauth_token_single(server: &MockServer, jwt: String) {
 }
 
 fn server_opts(codex_home: &tempfile::TempDir, issuer: String) -> ServerOptions {
-    let mut opts = ServerOptions::new(codex_home.path().to_path_buf(), "client-id".to_string());
+    let mut opts = ServerOptions::new(
+        codex_home.path().to_path_buf(),
+        "client-id".to_string(),
+        None,
+    );
     opts.issuer = issuer;
     opts.open_browser = false;
     opts
@@ -139,6 +143,42 @@ async fn device_code_login_integration_succeeds() {
     assert_eq!(tokens.account_id.as_deref(), Some("acct_321"));
 }
 
+#[tokio::test]
+async fn device_code_login_rejects_workspace_mismatch() {
+    skip_if_no_network!();
+
+    let codex_home = tempdir().unwrap();
+    let mock_server = MockServer::start().await;
+
+    mock_usercode_success(&mock_server).await;
+
+    mock_poll_token_two_step(&mock_server, Arc::new(AtomicUsize::new(0)), 404).await;
+
+    let jwt = make_jwt(json!({
+        "https://api.openai.com/auth": {
+            "chatgpt_account_id": "acct_321",
+            "organization_id": "org-actual"
+        }
+    }));
+
+    mock_oauth_token_single(&mock_server, jwt).await;
+
+    let issuer = mock_server.uri();
+    let mut opts = server_opts(&codex_home, issuer);
+    opts.forced_chatgpt_workspace_id = Some("org-required".to_string());
+
+    let err = run_device_code_login(opts)
+        .await
+        .expect_err("device code login should fail when workspace mismatches");
+    assert_eq!(err.kind(), std::io::ErrorKind::PermissionDenied);
+
+    let auth_path = get_auth_file(codex_home.path());
+    assert!(
+        !auth_path.exists(),
+        "auth.json should not be created when workspace validation fails"
+    );
+}
+
 #[tokio::test]
 async fn device_code_login_integration_handles_usercode_http_failure() {
     skip_if_no_network!();
@@ -183,7 +223,11 @@ async fn device_code_login_integration_persists_without_api_key_on_exchange_fail
 
     let issuer = mock_server.uri();
 
-    let mut opts = ServerOptions::new(codex_home.path().to_path_buf(), "client-id".to_string());
+    let mut opts = ServerOptions::new(
+        codex_home.path().to_path_buf(),
+        "client-id".to_string(),
+        None,
+    );
     opts.issuer = issuer;
     opts.open_browser = false;
 
@@ -226,7 +270,11 @@ async fn device_code_login_integration_handles_error_payload() {
 
     let issuer = mock_server.uri();
 
-    let mut opts = ServerOptions::new(codex_home.path().to_path_buf(), "client-id".to_string());
+    let mut opts = ServerOptions::new(
+        codex_home.path().to_path_buf(),
+        "client-id".to_string(),
+        None,
+    );
     opts.issuer = issuer;
     opts.open_browser = false;