OAuth filtering blocks user-configured OpenAI model aliases #13401

Summary

When using OpenAI OAuth auth mode, the Codex provider currently filters models with a hardcoded allowlist only.

Problem

Users can define custom OpenAI model keys/aliases in config, but those configured model IDs are removed during OAuth model filtering because they are not part of the static list.

Expected behavior

OAuth filtering should keep the default safe allowlist and also include user-configured OpenAI model IDs.

Impact

Configured model aliases cannot be selected in OAuth sessions even though they are valid user configuration.

Suggested fix

Build the OAuth allowlist from:

1. Existing built-in allowed model IDs
2. Keys from config.provider.openai.models

This preserves current behavior while enabling user-defined model aliases.