Adds the storage substrate for ccsx auth profile isolation.
Each Codex profile gets its own CODEX_HOME dir under
~/.ccs/codex-instances/<name>/ with isolated auth.json and
history.jsonl; config.toml is shared via symlink to ~/.codex/config.toml
so two terminals can run two Codex accounts simultaneously without
duplicating user config.
- CodexProfileRegistry (YAML, atomic write tmp.<pid>.<rand> + rename,
orphan cleanup, full CRUD + default pointer)
- decode-id-token: pure base64 JWT decoder for OpenAI id_token,
reads nested https://api.openai.com/auth claims (chatgpt_plan_type,
chatgpt_account_id) and dual-path email
- ensureSharedConfigSymlink: self-healing, idempotent, overwrites
stale entries with stderr warning
- 45 unit tests, all green
Foundation only — no CLI, no runtime injection, no dashboard.
Subsequent commits wire those in.
