Add forced_chatgpt_workspace_id and forced_login_method configuration options (#5303)

This PR adds support for configs to specify a forced login method
(chatgpt or api) as well as a forced chatgpt account id. This lets
enterprises uses [managed
configs](https://developers.openai.com/codex/security#managed-configuration)
to force all employees to use their company's workspace instead of their
own or any other.

When a workspace id is set, a query param is sent to the login flow
which auto-selects the given workspace or errors if the user isn't a
member of it.

This PR is large but a large % of it is tests, wiring, and required
formatting changes.

API login with chatgpt forced
<img width="1592" height="116" alt="CleanShot 2025-10-19 at 22 40 04"
src="https://github.com/user-attachments/assets/560c6bb4-a20a-4a37-95af-93df39d057dd"
/>

ChatGPT login with api forced
<img width="1018" height="100" alt="CleanShot 2025-10-19 at 22 40 29"
src="https://github.com/user-attachments/assets/d010bbbb-9c8d-4227-9eda-e55bf043b4af"
/>

Onboarding with api forced
<img width="892" height="460" alt="CleanShot 2025-10-19 at 22 41 02"
src="https://github.com/user-attachments/assets/cc0ed45c-b257-4d62-a32e-6ca7514b5edd"
/>

Onboarding with ChatGPT forced
<img width="1154" height="426" alt="CleanShot 2025-10-19 at 22 41 27"
src="https://github.com/user-attachments/assets/41c41417-dc68-4bb4-b3e7-3b7769f7e6a1"
/>

Logging in with the wrong workspace
<img width="2222" height="84" alt="CleanShot 2025-10-19 at 22 42 31"
src="https://github.com/user-attachments/assets/0ff4222c-f626-4dd3-b035-0b7fe998a046"
/>

codex-rs/tui/src/onboarding/onboarding_screen.rs

@@ -12,6 +12,7 @@ use ratatui::widgets::Clear;
 use ratatui::widgets::WidgetRef;
 
 use codex_app_server_protocol::AuthMode;
+use codex_protocol::config_types::ForcedLoginMethod;
 
 use crate::LoginStatus;
 use crate::onboarding::auth::AuthModeWidget;
@@ -83,6 +84,8 @@ impl OnboardingScreen {
             config,
         } = args;
         let cwd = config.cwd.clone();
+        let forced_chatgpt_workspace_id = config.forced_chatgpt_workspace_id.clone();
+        let forced_login_method = config.forced_login_method;
         let codex_home = config.codex_home;
         let mut steps: Vec<Step> = Vec::new();
         if show_windows_wsl_screen {
@@ -93,14 +96,20 @@ impl OnboardingScreen {
             tui.frame_requester(),
         )));
         if show_login_screen {
+            let highlighted_mode = match forced_login_method {
+                Some(ForcedLoginMethod::Api) => AuthMode::ApiKey,
+                _ => AuthMode::ChatGPT,
+            };
             steps.push(Step::Auth(AuthModeWidget {
                 request_frame: tui.frame_requester(),
-                highlighted_mode: AuthMode::ChatGPT,
+                highlighted_mode,
                 error: None,
                 sign_in_state: Arc::new(RwLock::new(SignInState::PickMode)),
                 codex_home: codex_home.clone(),
                 login_status,
                 auth_manager,
+                forced_chatgpt_workspace_id,
+                forced_login_method,
             }))
         }
         let is_git_repo = get_git_repo_root(&cwd).is_some();