fix(ai): park a Codex sign-in the issuer refused until the next sign-in

A dead refresh token was asked again on every hop of every run: the
proactive refresh failed and was swallowed, the request 401'd, the on-401
refresh failed again, and the nightly warm repeated that for the briefing
and every card. A refusal that proves the grant dead now flips the
connection to the existing expired state (compare-and-set on the refused
token, one signal per transition), so the chain, the presence probe and
the AI capabilities stop counting it. A new device-code sign-in clears the
refused credential's ledger rows so the fresh one resumes in place.

src/app/api/admin/central-codex/device-poll/route.ts

@@ -8,6 +8,7 @@ import { prisma } from "@/lib/db";
 import { auditLog } from "@/lib/auth/audit";
 import { getClientIp, apiSuccess, apiError } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
+import { forgetProviderHealth } from "@/lib/ai/provider-health-ledger";
 
 /**
  * Operator-shared central Codex — device-code poll (admin only).
@@ -91,6 +92,9 @@ export const POST = apiHandler(async (request: NextRequest) => {
   });
 
   cookieStore.delete("central_codex_device");
+  // A new central sign-in: every account's ledger rows describe the refused
+  // one, and the central connection is one credential shared by all of them.
+  await forgetProviderHealth({ providerType: "admin-codex" });
 
   await auditLog("admin.central-codex.connected", {
     userId: user.id,