Require the OAuth state on the Codex callback (sec #4)

The Codex flow guarded with `result.state && result.state !== state`,
so a callback that simply omitted state skipped CSRF validation while a
sign-in window was open. Match the Anthropic and Google flows: compare
strictly, so a missing or mismatched state is rejected. PKCE already
blocks code injection; this closes the login-CSRF gap.

AgentCompany-New/src/main/services/oauth/openai-codex-flow.ts

@@ -103,7 +103,7 @@ export const openaiCodexFlow: OAuthFlow = {
     try {
       callbacks.onAuth({ url: buildAuthorizeUrl(challenge, state), instructions: "Complete the ChatGPT sign-in in your browser." });
       const result = await server.waitForCode();
-      if (result.state && result.state !== state) throw new Error("OAuth state mismatch.");
+      if (result.state !== state) throw new Error("OAuth state mismatch.");
       const tokens = await exchangeCode(result.code, verifier);
       const accountId = extractAccountId(tokens.access);
       if (!accountId) throw new Error("Could not read the ChatGPT account id from the token.");