Add codex2api as a protocol-first OAuth source

This keeps the existing CPA, SUB2API, and contribution flows intact
while introducing codex2api as a separate source that plugs into
Step 7 and Step 10 through backend APIs instead of page DOM.

The sidepanel now exposes codex2api settings, preserves the built-in
local default through placeholder-only UI, and accepts user-provided
public admin URLs. Step 7 now treats missing or invalid management
secrets as terminal config errors so the flow stops instead of retrying
needlessly.

Constraint: New source must be additive and must not break existing CPA/SUB2API/contribution paths
Rejected: Drive codex2api through admin page button clicks | too brittle against frontend DOM changes
Rejected: Reuse contribution mode as a source surface | violates existing panelMode/runtime-mode boundary
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep codex2api on the protocol path unless its API becomes insufficient; do not add a panel content script without proving the protocol path cannot work
Tested: npm test; targeted codex2api/auth retry loops repeated 40 times; full suite repeated 5 times
Not-tested: Real browser run against a live codex2api instance with a real Admin Secret and OpenAI authorization

background/navigation-utils.js

@@ -3,6 +3,7 @@
 })(typeof self !== 'undefined' ? self : globalThis, function createBackgroundNavigationUtilsModule() {
   function createNavigationUtils(deps = {}) {
     const {
+      DEFAULT_CODEX2API_URL,
       DEFAULT_SUB2API_URL,
       normalizeLocalCpaStep9Mode,
     } = deps;
@@ -27,13 +28,36 @@
       return parsed.toString();
     }
 
+    function normalizeCodex2ApiUrl(rawUrl) {
+      const input = (rawUrl || '').trim() || DEFAULT_CODEX2API_URL;
+      const withProtocol = /^https?:\/\//i.test(input) ? input : `http://${input}`;
+      const parsed = new URL(withProtocol);
+      if (!parsed.pathname || parsed.pathname === '/' || parsed.pathname === '/admin') {
+        parsed.pathname = '/admin/accounts';
+      }
+      parsed.hash = '';
+      return parsed.toString();
+    }
+
     function getPanelMode(state = {}) {
-      return state.panelMode === 'sub2api' ? 'sub2api' : 'cpa';
+      if (state.panelMode === 'sub2api') {
+        return 'sub2api';
+      }
+      if (state.panelMode === 'codex2api') {
+        return 'codex2api';
+      }
+      return 'cpa';
     }
 
     function getPanelModeLabel(modeOrState) {
       const mode = typeof modeOrState === 'string' ? modeOrState : getPanelMode(modeOrState);
-      return mode === 'sub2api' ? 'SUB2API' : 'CPA';
+      if (mode === 'sub2api') {
+        return 'SUB2API';
+      }
+      if (mode === 'codex2api') {
+        return 'Codex2API';
+      }
+      return 'CPA';
     }
 
     function isSignupPageHost(hostname = '') {
@@ -124,6 +148,14 @@
               || candidate.pathname.startsWith('/login')
               || candidate.pathname === '/'
             );
+        case 'codex2api-panel':
+          return Boolean(reference)
+            && candidate.origin === reference.origin
+            && (
+              candidate.pathname.startsWith('/admin/accounts')
+              || candidate.pathname === '/admin'
+              || candidate.pathname === '/'
+            );
         default:
           return false;
       }
@@ -160,6 +192,7 @@
       isSignupPageHost,
       isSignupPasswordPageUrl,
       matchesSourceUrlFamily,
+      normalizeCodex2ApiUrl,
       normalizeSub2ApiUrl,
       parseUrlSafely,
       shouldBypassStep9ForLocalCpa,