Add codex2api as a protocol-first OAuth source

This keeps the existing CPA, SUB2API, and contribution flows intact
while introducing codex2api as a separate source that plugs into
Step 7 and Step 10 through backend APIs instead of page DOM.

The sidepanel now exposes codex2api settings, preserves the built-in
local default through placeholder-only UI, and accepts user-provided
public admin URLs. Step 7 now treats missing or invalid management
secrets as terminal config errors so the flow stops instead of retrying
needlessly.

Constraint: New source must be additive and must not break existing CPA/SUB2API/contribution paths
Rejected: Drive codex2api through admin page button clicks | too brittle against frontend DOM changes
Rejected: Reuse contribution mode as a source surface | violates existing panelMode/runtime-mode boundary
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep codex2api on the protocol path unless its API becomes insufficient; do not add a panel content script without proving the protocol path cannot work
Tested: npm test; targeted codex2api/auth retry loops repeated 40 times; full suite repeated 5 times
Not-tested: Real browser run against a live codex2api instance with a real Admin Secret and OpenAI authorization

tests/sidepanel-contribution-mode.test.js

@@ -135,6 +135,8 @@ const inputSub2ApiEmail = { value: 'user@example.com' };
 const inputSub2ApiPassword = { value: 'sub-secret' };
 const inputSub2ApiGroup = { value: ' codex ' };
 const inputSub2ApiDefaultProxy = { value: ' proxy-a ' };
+const inputCodex2ApiUrl = { value: 'http://localhost:8080/admin/accounts' };
+const inputCodex2ApiAdminKey = { value: 'codex-admin-secret' };
 const inputPassword = { value: 'Secret123!' };
 const selectMailProvider = { value: '163' };
 const selectEmailGenerator = { value: 'duck' };
@@ -196,6 +198,8 @@ return {
   assert.equal(normalPayload.customPassword, 'Secret123!');
   assert.equal(normalPayload.accountRunHistoryTextEnabled, true);
   assert.equal(normalPayload.accountRunHistoryHelperBaseUrl, 'http://127.0.0.1:17373');
+  assert.equal(normalPayload.codex2apiUrl, 'http://localhost:8080/admin/accounts');
+  assert.equal(normalPayload.codex2apiAdminKey, 'codex-admin-secret');
 });
 
 test('contribution mode manager enters mode, starts main auto flow, polls contribution status, and exits cleanly', async () => {
@@ -264,6 +268,8 @@ test('contribution mode manager enters mode, starts main auto flow, polls contri
     rowSub2ApiGroup: createElement(),
     rowSub2ApiPassword: createElement(),
     rowSub2ApiUrl: createElement(),
+    rowCodex2ApiUrl: createElement(),
+    rowCodex2ApiAdminKey: createElement(),
     rowVpsPassword: createElement(),
     rowVpsUrl: createElement(),
     selectPanelMode: createElement({ value: 'sub2api' }),
@@ -414,6 +420,8 @@ test('contribution mode manager enters mode, starts main auto flow, polls contri
   assert.equal(dom.contributionModeSummary.textContent.length > 0, true);
   assert.equal(dom.btnContributionMode.classList.contains('is-active'), true);
   assert.equal(dom.rowVpsUrl.classList.contains('is-contribution-hidden'), true);
+  assert.equal(dom.rowCodex2ApiUrl.classList.contains('is-contribution-hidden'), true);
+  assert.equal(dom.rowCodex2ApiAdminKey.classList.contains('is-contribution-hidden'), true);
   assert.ok(closeConfigMenuCount >= 1);
   assert.ok(closeAccountRecordsCount >= 1);
   assert.ok(updatePanelModeCount >= 1);