feat(codex): add realtime hangup forwarding and local client-secret support

- Add Codex live handlers for unsupported translation/transcription/SIP endpoints, returning standardized `realtime_capability_not_supported` errors.
- Implement `HandleHangup` to validate call ownership, select/refresh pinned OAuth credentials, forward hangup requests to upstream, and complete local session on success.
- Add ephemeral client-secret infrastructure for local ephemeral auth: create/authenticate endpoints, token storage with expiry/capacity limits, session normalization/model mapping, and unified realtime error handling.

Closes: #4726