fix(model): prevent Codex token double counting

[Yif-Yang]

Summary

• give the Codex backend its own TokenTracker
• prevent Claude and Codex summaries from aggregating the same shared tracker twice
• add a non-mocked regression test that records one Codex call and requires exactly one aggregate call

Root cause

PR #112 added Codex as an optimizer and correctly aggregated its token summary, but Claude and Codex both referenced the same tracker from model.common. Aggregating both backend summaries therefore doubled calls and token totals.

Verification

• 13 Codex optimizer tests passed
• full suite: 313 passed, 6 skipped
• git diff --check passed
• independent read-only Claude Opus review found no blockers