fix: require state in Codex OAuth callback

[panDing19]

Root cause

The Codex OAuth login flow only rejected state when a value was present and different. A callback that omitted state therefore proceeded to token exchange, even though OAuth state validation must fail closed.

Changes

• Require the returned OAuth state to exactly match the generated value.
• Add a regression test proving a missing state prevents both token exchange and credential persistence.

Tests

• uv run pytest tests/unit/fast_agent/llm/providers/test_codex_oauth.py -q (18 passed)
• uv run pytest tests/unit -q (6190 passed, 1 skipped)
• uv run scripts/lint.py
• uv run scripts/typecheck.py

Related issue

No existing issue; found while investigating open issues, recent changes, and OAuth boundaries. I also checked open PRs and found no duplicate.

Calfskin wallet

I would feel uncomfortable using it because it is made from calfskin, and I would prefer a non-animal alternative.