security: fix rate limiting, error message leaks, decrypt crash, key preview

- H1: Add checkRateLimit to OAuth authorize/callback/disconnect + admin AI settings
- H2: Fix decrypt("") crash in provider.ts onTokenRefresh by using decrypt() directly
- H3: Truncate error messages in codex-oauth, codex-client, openai-client to prevent leaking upstream response bodies
- M5: Fix keyPreview to show last 4 chars of decrypted key instead of ciphertext prefix

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/app/api/auth/codex/authorize/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
-import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { apiHandler, requireAuth, HttpError } from "@/lib/api-handler";
+import { checkRateLimit } from "@/lib/rate-limit";
 import {
   generatePKCE,
   generateState,
@@ -9,7 +10,10 @@ import { cookies } from "next/headers";
 import { annotate } from "@/lib/logging/context";
 
 export const GET = apiHandler(async (_request: NextRequest) => {
-  await requireAuth();
+  const { user } = await requireAuth();
+
+  const rl = await checkRateLimit(`codex-authorize:${user.id}`, 5, 60_000);
+  if (!rl.allowed) throw new HttpError(429, "Too many requests");
 
   const { verifier, challenge } = generatePKCE();
   const state = generateState();

src/app/api/auth/codex/callback/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { checkRateLimit } from "@/lib/rate-limit";
 import { exchangeCodeForTokens, encryptTokens } from "@/lib/ai/codex-oauth";
 import { prisma } from "@/lib/db";
 import { auditLog } from "@/lib/auth/audit";
@@ -9,6 +10,13 @@ import { annotate } from "@/lib/logging/context";
 
 export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
+
+  const rl = await checkRateLimit(`codex-callback:${user.id}`, 10, 60_000);
+  if (!rl.allowed) {
+    const appUrl = process.env.APP_URL || process.env.NEXT_PUBLIC_APP_URL;
+    return NextResponse.redirect(`${appUrl}/settings?codex_error=rate_limited`);
+  }
+
   const url = new URL(request.url);
 
   const code = url.searchParams.get("code");

src/app/api/auth/codex/disconnect/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest } from "next/server";
-import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { apiHandler, requireAuth, HttpError } from "@/lib/api-handler";
+import { checkRateLimit } from "@/lib/rate-limit";
 import { prisma } from "@/lib/db";
 import { auditLog } from "@/lib/auth/audit";
 import { apiSuccess, getClientIp } from "@/lib/api-response";
@@ -8,6 +9,9 @@ import { annotate } from "@/lib/logging/context";
 export const DELETE = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
+  const rl = await checkRateLimit(`codex-disconnect:${user.id}`, 5, 60_000);
+  if (!rl.allowed) throw new HttpError(429, "Too many requests");
+
   await prisma.user.update({
     where: { id: user.id },
     data: {