Wire the app-backed UI through a new internal ephemeral API-key login path so /api-provision can reuse the browser provisioning flow, persist OPENAI_API_KEY to .env, and hot-apply the key without writing auth.json.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit e7d7aebb48)