Expose onboarding hints in login completion notifications (#36635)

## What changed

- Accept the allowlisted `.onboarding_entrypoint=life_sciences` suffix on a valid OAuth state while continuing to reject unknown or malformed suffixes.
- Return the parsed callback metadata from the login server without including the suffix in the token exchange redirect URI.
- Add the optional `onboardingEntrypoint` field and `life_sciences` value to the v2 `account/login/completed` notification and generated protocol exports.

## Testing

- Cover valid, invalid, and repeated OAuth state suffixes.
- Verify the end-to-end login callback result, token redirect URI, and app-server notification payload.

GitOrigin-RevId: c2ee146328ddd43c03a503260d5d492e186fa889

codex-rs/login/tests/suite/login_server_e2e.rs

@@ -11,6 +11,8 @@ use base64::Engine;
 use codex_config::types::AuthCredentialsStoreMode;
 use codex_http_client::HttpClientBuilder;
 use codex_login::AuthKeyringBackendKind;
+use codex_login::LoginCallbackResult;
+use codex_login::LoginOnboardingEntrypoint;
 use codex_login::LoginSuccessPage;
 use codex_login::LoginSuccessPageBrand;
 use codex_login::ServerOptions;
@@ -149,7 +151,9 @@ async fn end_to_end_login_flow_persists_auth_json() -> Result<()> {
     let client = HttpClientBuilder::new()
         .without_redirects()
         .build_direct()?;
-    let url = format!("http://127.0.0.1:{login_port}/auth/callback?code=abc&state=test_state_123");
+    let url = format!(
+        "http://127.0.0.1:{login_port}/auth/callback?code=abc&state=test_state_123.onboarding_entrypoint=life_sciences"
+    );
     let resp = client.get(&url).send().await?;
     assert_eq!(resp.status(), 302);
     let success_url = resp.headers()["location"].to_str()?;
@@ -161,7 +165,13 @@ async fn end_to_end_login_flow_persists_auth_json() -> Result<()> {
     assert!(success_resp.status().is_success());
 
     // Wait for server shutdown
-    server.block_until_done().await?;
+    let callback_result = server.block_until_done_with_callback_result().await?;
+    assert_eq!(
+        callback_result,
+        LoginCallbackResult {
+            onboarding_entrypoint: Some(LoginOnboardingEntrypoint::LifeSciences),
+        }
+    );
 
     // Validate auth.json
     let auth_path = codex_home.join("auth.json");