feat: Codex account rotation + fix rate-limit detection

- New codex-token-rotation module: rotates between multiple
  ~/.codex-accounts/{n}/auth.json on rate-limit
- Copies active account auth to session dir before each spawn
- Fix detectFallbackTrigger to match "usage limit" / "hit your limit"
- Fix streamed error detection: remove claude-only guard so codex
  rate-limit errors are caught even when output.status is "success"
- Add rotation in both task-scheduler and message-agent-executor

src/task-scheduler.ts

@@ -29,6 +29,17 @@ import {
 } from './group-folder.js';
 import { logger } from './logger.js';
 import { createTaskStatusTracker } from './task-status-tracker.js';
+import { detectFallbackTrigger } from './provider-fallback.js';
+import {
+  rotateCodexToken,
+  getCodexAccountCount,
+  markCodexTokenHealthy,
+} from './codex-token-rotation.js';
+import {
+  rotateToken,
+  getTokenCount,
+  markTokenHealthy,
+} from './token-rotation.js';
 import {
   evaluateTaskSuspension,
   formatSuspensionNotice,
@@ -315,6 +326,27 @@ async function runTask(
     updateTask(task.id, { suspended_until: null });
   }
 
+  // Try token rotation before suspending
+  if (error) {
+    const trigger = detectFallbackTrigger(error);
+    if (trigger.shouldFallback) {
+      const isCodex = SERVICE_AGENT_TYPE === 'codex';
+      const rotated = isCodex
+        ? getCodexAccountCount() > 1 && rotateCodexToken()
+        : getTokenCount() > 1 && rotateToken();
+      if (rotated) {
+        logger.info(
+          { taskId: task.id, agent: SERVICE_AGENT_TYPE, reason: trigger.reason },
+          'Task rate-limited, rotated token — will retry on next schedule',
+        );
+        if (isCodex) markCodexTokenHealthy();
+        else markTokenHealthy();
+        // Clear the error so suspension doesn't trigger
+        error = null;
+      }
+    }
+  }
+
   // Check for repeated quota/auth errors → auto-suspend
   let suspended = false;
   if (error) {