feat(codex): add Tauri commands and multi-account refresh lanes (PR 2/5)

[BlazzzPlay]

Summary

• Add the ADR 0003 shell layer on top of the domain PR (feat(codex): port multi-account Codex domain core (PR 1/5) #255).
• New commands/codex_accounts.rs: Tauri commands for account list/add/remove/switch/fetch/snapshots + restart Codex Desktop, registered in main.rs.
• Multi-account refresh: when Codex is enabled, a parallel per-account lane refreshes every account snapshot on the same cycle, bounded by the shared fetch semaphore. Ambient account still publishes the single "codex" provider snapshot.

Related issue

ADR 0003 (docs/adr/0003-multi-account-codex.md). No issue number yet.

Affected areas

• Tray panel
• Settings UI
• Config file / settings persistence
• Provider-specific behavior
• Installer / release packaging
• Startup / background behavior (refresh lanes spawn in provider refresh cycle)
• Documentation
• Other:

Validation

Hosted PR check runs on Blacksmith Windows when CI_BUDGET_MODE is not off (see .github/workflows/pr-check.yml and CONTEXT.md). Still run the local slice and list commands/results below. If a check is not relevant, say why.

• powershell.exe -ExecutionPolicy Bypass -NoProfile -File scripts\local-check.ps1
• For full pre-release validation: powershell.exe -ExecutionPolicy Bypass -NoProfile -File scripts\local-check.ps1 -All -Version <version>
• For installer/release changes: powershell.exe -File scripts\windows-release-build.ps1 -Ref <ref> -SmokeInstall
• Thermo-nuclear code quality review completed before submitting: https://github.com/cursor/plugins/blob/main/cursor-team-kit/skills/thermo-nuclear-code-quality-review/SKILL.md
• Other: cargo build --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml OK; 2 command unit tests pass

UI / tray proof

For UI, tray, settings, or visual behavior changes, use CUA Driver for visual proof. If CUA Driver cannot be used, explain why and attach equivalent manual proof.

• Not applicable (shell commands only; no visual surface changed yet)
• CUA Driver visual proof attached
• CUA Driver could not be used; equivalent manual proof and explanation attached

Notes for reviewers

• Depends on feat(codex): port multi-account Codex domain core (PR 1/5) #255 (domain). This branch is based on the PR feat(codex): port multi-account Codex domain core (PR 1/5) #255 branch, so the diff against main currently shows both; after feat(codex): port multi-account Codex domain core (PR 1/5) #255 merges it will be rebased onto main and show only this slice.
• The multi-lane refresh in providers.rs keeps the ambient "codex" snapshot for tray/menu unchanged; lanes only fill the account snapshot store for the Settings panel.

Chain Context

Field	Value
Chain	codex-multi-account (ADR 0003)
Tracker PR	Not needed (stacked PRs to main)
Position	2 of 5
Base	main (rebase after #255 merges)
Depends on	#255 (domain core)
Follow-up	#3 frontend bridge + i18n
Review budget	393 / 400
Starts at	#255 merged state
Ends with	Codex account Tauri commands + parallel lanes refresh compile green

Chain Overview

main
 ├── #255 domain core (rust/src/codex_accounts) — merged/reviewed
 └── 📍 #2 This PR — shell commands + multi-lane refresh
      └── #3 frontend bridge + i18n
           └── #4 settings accounts panel
                └── #5 tray menu flyout

Scope

• Includes: commands/codex_accounts.rs, command registration (main.rs, commands/mod.rs), multi-lane refresh (providers.rs), CODEX_ACCOUNTS_UPDATED event (events.rs).
• Excludes: frontend bridge/types, i18n keys, UI panels — follow-up PRs.

Autonomy

• CI is expected to pass for this PR branch
• This PR has one deliverable scope
• This PR can be rolled back without unrelated changes
• Tests cover this unit (2 command unit tests)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Finesssee]

Thanks for the PR, I will review this ASAP.

[Finesssee]

Thermo-nuclear review (2/5 — shell): approve on structure once #255's ADR lands.

The command surface is disciplined: codex_accounts.rs keeps one thin invoke layer (list/add/remove/switch/fetch/snapshots + restart-desktop) without leaking manager internals through the bridge, and DTOs route through CodexSwitchResult camelCase serde consistently. The multi-account refresh lanes correctly bound parallelism through the shared fetch semaphore rather than inventing a second throttle — that's the right reuse; ambient-Codex snapshot publication staying on the single codex provider channel (no double-publish) is the correct narrow carve-out until the ambient path's fate is settled by the #255 ADR.

Two nits: (a) the per-account lane borrows the ambient refresh interval — fine for now, but the ADR should say whether lanes co-own adaptive_delay decisions; (b) commands/mod.rs registration order doesn't matter here but keep codex_accounts adjacent to the other Codex commands (codex_workspaces) for scan-ability.