feat: add STT support, Gemini TTS, and expand usage tracking

- Speech-to-Text: full pipeline with sttCore handler, /v1/audio/transcriptions
  endpoint, sttConfig for OpenAI, Gemini, Groq, Deepgram, AssemblyAI,
  HuggingFace, NVIDIA Parakeet; new 9router-stt skill
- Gemini TTS: add gemini provider with 30 prebuilt voices and TTS_PROVIDER_CONFIG
- Usage: implement GLM (intl/cn) and MiniMax (intl/cn) quota fetchers; refactor
  Gemini CLI usage to use retrieveUserQuota with per-model buckets
- Disabled models: lowdb-backed disabledModelsDb + /api/models/disabled route
- Header search: reusable Zustand store (headerSearchStore) wired into Header
- CLI tools: add Claude Cowork tool card and cowork-settings API
- Providers: introduce mediaPriority sorting in getProvidersByKind, add
  Kimi K2.6, reorder hermes, drop qwen STT kind
- UI: expand media-providers/[kind]/[id] page (+314), enhance OAuthModal,
  ModelSelectModal, ProviderTopology, ProxyPools, ProviderLimits
- Assets: refresh provider PNGs (alicode, byteplus, cloudflare-ai, nvidia,
  ollama, vertex, volcengine-ark) and add aws-polly, fal-ai, jina-ai, recraft,
  runwayml, stability-ai, topaz, black-forest-labs

src/shared/components/OAuthModal.js

@@ -173,24 +173,13 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
       // Authorization code flow - build redirect URI (some providers require fixed ports)
       const appPort = window.location.port || (window.location.protocol === "https:" ? "443" : "80");
       let redirectUri;
-      let codexProxyActive = false;
-
       if (provider === "codex") {
-        // Try to start proxy on fixed port 1455 → redirect callback to app port
-        try {
-          const proxyRes = await fetch(`/api/oauth/codex/start-proxy?app_port=${appPort}`);
-          const proxyData = await proxyRes.json();
-          codexProxyActive = proxyData.success;
-        } catch {
-          codexProxyActive = false;
-        }
-        // Always use fixed port 1455 as redirect_uri (Codex requirement)
         redirectUri = "http://localhost:1455/auth/callback";
       } else {
         redirectUri = `http://localhost:${appPort}/callback`;
       }
 
-      // Build authorize URL, optionally passing provider-specific metadata (e.g. gitlab clientId)
+      // Build authorize URL first to get codeVerifier/state for codex server-side mode
       const authorizeUrl = new URL(`/api/oauth/${provider}/authorize`, window.location.origin);
       authorizeUrl.searchParams.set("redirect_uri", redirectUri);
       if (oauthMeta) {
@@ -200,10 +189,29 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
       const data = await res.json();
       if (!res.ok) throw new Error(data.error);
 
-      setAuthData({ ...data, redirectUri });
+      // Codex: start proxy with server-side session (auto-exchange) + fallback to channels
+      let codexProxyActive = false;
+      let codexServerSide = false;
+      if (provider === "codex") {
+        try {
+          const proxyUrl = new URL(`/api/oauth/codex/start-proxy`, window.location.origin);
+          proxyUrl.searchParams.set("app_port", appPort);
+          proxyUrl.searchParams.set("state", data.state);
+          proxyUrl.searchParams.set("code_verifier", data.codeVerifier);
+          proxyUrl.searchParams.set("redirect_uri", redirectUri);
+          const proxyRes = await fetch(proxyUrl.toString());
+          const proxyData = await proxyRes.json();
+          codexProxyActive = proxyData.success;
+          codexServerSide = !!proxyData.serverSide;
+        } catch {
+          codexProxyActive = false;
+        }
+      }
+
+      setAuthData({ ...data, redirectUri, codexServerSide });
 
       if (provider === "codex" && codexProxyActive) {
-        // Proxy active: callback will redirect to app port automatically
+        // Proxy active: callback will be handled server-side (auto-exchange) or via channels (fallback)
         setStep("waiting");
         popupRef.current = window.open(data.authUrl, "oauth_popup", "width=600,height=700");
         if (!popupRef.current) {
@@ -247,6 +255,49 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
     }
   }, [isOpen, provider, startOAuthFlow]);
 
+  // Codex server-side mode: poll status (proxy auto-exchanges + saves DB)
+  useEffect(() => {
+    if (!authData?.codexServerSide || !authData?.state) return;
+    if (callbackProcessedRef.current) return;
+    let cancelled = false;
+    const POLL_INTERVAL_MS = 1500;
+    const MAX_ATTEMPTS = 200; // ~5 minutes
+    let attempts = 0;
+
+    const tick = async () => {
+      if (cancelled || callbackProcessedRef.current) return;
+      attempts += 1;
+      try {
+        const res = await fetch(`/api/oauth/codex/poll-status?state=${encodeURIComponent(authData.state)}`);
+        const data = await res.json();
+        if (cancelled || callbackProcessedRef.current) return;
+        if (data.status === "done") {
+          callbackProcessedRef.current = true;
+          setStep("success");
+          onSuccess?.();
+          return;
+        }
+        if (data.status === "error") {
+          callbackProcessedRef.current = true;
+          setError(data.error || "Authentication failed");
+          setStep("error");
+          return;
+        }
+      } catch {
+        // Network error, keep polling
+      }
+      if (attempts >= MAX_ATTEMPTS) {
+        callbackProcessedRef.current = true;
+        setError("Authentication timeout");
+        setStep("error");
+        return;
+      }
+      setTimeout(tick, POLL_INTERVAL_MS);
+    };
+    setTimeout(tick, POLL_INTERVAL_MS);
+    return () => { cancelled = true; };
+  }, [authData, onSuccess]);
+
   // Listen for OAuth callback via multiple methods
   useEffect(() => {
     if (!authData) return;