feat: add Codex runtime and GitLab personal storage

[charpty]

Summary

• add a Codex CLI runtime alongside the existing Claude Agent SDK path
• add GitLab-compatible personal storage while keeping GitHub as the default
• support keyless local Codex authentication, provider/model configuration, session resume, usage reporting, and structured JSONL errors
• support standard GitLab token auth plus an administrator-pinned SSH repository path for self-hosted deployments
• document runtime boundaries, administrator setup, troubleshooting, and GitLab operation

Why

Loopat previously assumed that every AI provider ran through Claude Code and that personal storage lived on GitHub. This change makes both boundaries explicit and extensible:

• AI providers now select either the existing claude runtime or the new codex runtime.
• Personal storage continues to use the existing GitHostProvider abstraction, with GitLab added as another built-in implementation.

Existing Claude and GitHub configurations remain backward compatible.

Design

Codex runtime

Codex command construction, provider environment mapping, and JSONL event parsing live in server/src/codex-cli.ts. The session layer translates those events into Loopat messages and owns process lifecycle, thread persistence, interruption, queueing, auto-naming, and usage reporting.

Codex runs through the host CLI and does not initialize Claude settings, plugins, MCP servers, podman containers, or the Anthropic egress gateway.

GitLab personal storage

The GitLab provider normalizes web/API URLs, supports multiple token transport conventions, preserves full namespace/project paths, and reuses the platform-neutral personal repository flow.

For self-hosted installations whose API is behind SSO, administrators can pin a full SSH repository. That mode uses the Loopat process account's SSH identity and preserves a valid configured Git commit author. The implementation contains no deployment-specific hostnames or account identifiers.

Validation

• bun test server/test/codex-cli.test.ts server/test/gitlab.test.ts server/test/git-author.test.ts — 18 passed
• bunx tsc -p server/tsconfig.json --noEmit
• bun run build — Rust binaries, web TypeScript, and Vite build passed
• Dogfood smoke was not run because the validation environment did not provide ANTHROPIC_API_KEY