fix: remove Codex API key auth path, add secret redaction and d7 auto-rotation

- Remove OPENAI_API_KEY from .env and Codex child process env to prevent
  API billing when subscription quota is exhausted
- Remove writeCodexApiKeyAuth entirely — Codex now uses OAuth only
- Add 9-pattern secret redaction in formatOutbound() to prevent key leaks
- Fix Codex usage bucket aggregation: use 'codex' bucket only instead of
  max across all buckets (bengalfox = Codex Spark, not needed)
- Add d7≥100% auto-rotation in updateCodexAccountUsage to skip exhausted
  accounts and prevent API billing fallback
- Add findNextCodexAvailable that checks both rate-limits and d7 usage
- Clean stale apikey auth.json files from all session directories
- Update tests: OAuth-only auth, d7 auto-skip (3 new tests), dashboard

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/router.ts

@@ -28,10 +28,35 @@ export function stripInternalTags(text: string): string {
   return text.replace(/<internal>[\s\S]*?<\/internal>/g, '').trim();
 }
 
+/**
+ * Patterns that match common API keys / tokens.
+ * Matched strings are replaced with `[REDACTED]`.
+ */
+const SECRET_PATTERNS: RegExp[] = [
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,        // Anthropic
+  /sk-[A-Za-z0-9_-]{20,}/g,            // OpenAI
+  /gsk_[A-Za-z0-9_-]{20,}/g,           // Groq
+  /xai-[A-Za-z0-9_-]{20,}/g,           // xAI
+  /ghp_[A-Za-z0-9_]{36,}/g,            // GitHub PAT classic
+  /github_pat_[A-Za-z0-9_]{20,}/g,     // GitHub PAT fine-grained
+  /glpat-[A-Za-z0-9_-]{20,}/g,         // GitLab PAT
+  /AKIA[A-Z0-9]{16}/g,                 // AWS Access Key
+  /Bearer\s+eyJ[A-Za-z0-9_-]{40,}/g,   // Bearer JWT
+];
+
+function redactSecrets(text: string): string {
+  let result = text;
+  for (const pattern of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, '[REDACTED]');
+  }
+  return result;
+}
+
 export function formatOutbound(rawText: string): string {
   const text = stripInternalTags(rawText);
   if (!text) return '';
-  return text;
+  return redactSecrets(text);
 }
 
 export function findChannel(