Support `codex login --device-auth` login mode for better agent-friendly automation

[yankay]

The codex login --device-auth login mode looks very agent-friendly and would be a great fit for headless / automated scenarios. It would be valuable to support (or recommend) this login flow because:

• Non-interactive authentication: No need for a human to open a browser or paste tokens in a TTY. The device code flow lets an agent display a code/URL and complete auth out-of-band.
• CI/CD and bot friendly: Works well for CI pipelines, automation bots, background services, and remote/sandboxed environments where interactive browser login is not possible.
• More secure than long-lived secrets: Avoids storing plaintext credentials or long-lived PATs; tokens are issued via the standard OAuth 2.0 Device Authorization Grant (RFC 8628).
• Easier large-scale rollout: Simplifies onboarding across many machines/agents — operators just approve a device code once instead of provisioning credentials per host.

Prior art — tools that already do this well

Many widely-used CLIs have adopted the OAuth 2.0 Device Authorization Grant (RFC 8628) precisely because it works great for agents, containers, and headless boxes:

• GitHub CLI — gh auth login (uses device code flow by default for non-web environments; prompts the user to open https://github.com/login/device and enter a one-time code).
• Google Cloud SDK — gcloud auth login --no-launch-browser (prints a URL + code for out-of-band approval, ideal for SSH / remote shells).
• Azure CLI — az login --use-device-code (the canonical device-code flow for Azure automation and remote hosts).
• AWS CLI v2 / IAM Identity Center (SSO) — aws sso login (device authorization flow against IAM Identity Center).
• HashiCorp Vault — OIDC auth method with device code support for CLI logins.
• kubectl / kubelogin — OIDC plugins supporting device code flow for Kubernetes cluster auth.
• Docker / Docker Hub — docker login device code flow for personal access in headless setups.
• Hugging Face CLI — huggingface-cli login device flow for notebooks and remote runners.
• Stripe CLI — stripe login uses a device-pairing flow with a one-time code.
• Cloudflare wrangler — wrangler login device-style OAuth for CI/headless use.
• 1Password CLI / GitLab CLI (glab auth login) — both expose device/OAuth flows suitable for agents.

Suggested next steps

• Evaluate adopting / documenting codex login --device-auth as the recommended login method for agent use cases.
• Provide an example workflow showing how an agent triggers device auth, displays the verification URL + user code, and polls the token endpoint until approval.
• Add guidance on token storage, scopes, refresh, and revocation for automated environments.
• Consider parity with gh auth login UX (clear prompt, copy-friendly code, browser-or-out-of-band option) as a north-star design.

This would meaningfully improve the experience for anyone using this project from an agent or automation context.