Add /api-provision to app-server TUI

Wire the app-backed UI through a new internal ephemeral API-key login path so /api-provision can reuse the browser provisioning flow, persist OPENAI_API_KEY to .env, and hot-apply the key without writing auth.json.

Co-authored-by: Codex <noreply@openai.com>

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -8425,6 +8425,27 @@
             "title": "ApiKeyv2::LoginAccountParams",
             "type": "object"
           },
+          {
+            "description": "[UNSTABLE] FOR OPENAI INTERNAL USE ONLY - DO NOT USE.",
+            "properties": {
+              "apiKey": {
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "ephemeralApiKey"
+                ],
+                "title": "EphemeralApiKeyv2::LoginAccountParamsType",
+                "type": "string"
+              }
+            },
+            "required": [
+              "apiKey",
+              "type"
+            ],
+            "title": "EphemeralApiKeyv2::LoginAccountParams",
+            "type": "object"
+          },
           {
             "properties": {
               "type": {