Add proactive token refresh lead times for providers and implement Codex proxy management

open-sse/services/projectId.js

@@ -1,7 +1,6 @@
 /**
  * Project ID Service - Fetch and cache real Project IDs from Google Cloud Code API
  *
- * Reference: CLIProxyAPI internal/auth/antigravity/auth.go (FetchProjectID + OnboardUser)
  *
  * Instead of generating random project IDs (e.g. "useful-spark-a1b2c"),
  * this service fetches the real Project ID bound to the authenticated user's account.

open-sse/services/tokenRefresh.js

@@ -1,9 +1,14 @@
 import { PROVIDERS } from "../config/providers.js";
-import { OAUTH_ENDPOINTS, GITHUB_COPILOT } from "../config/appConstants.js";
+import { OAUTH_ENDPOINTS, GITHUB_COPILOT, REFRESH_LEAD_MS } from "../config/appConstants.js";
 
-// Token expiry buffer (refresh if expires within 5 minutes)
+// Default token expiry buffer (refresh if expires within 5 minutes)
 export const TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000;
 
+// Get provider-specific refresh lead time, falls back to default buffer
+export function getRefreshLeadMs(provider) {
+  return REFRESH_LEAD_MS[provider] || TOKEN_EXPIRY_BUFFER_MS;
+}
+
 /**
  * Refresh OAuth access token using refresh token
  */