Restore app-server websocket listener with auth guard (#22404)

## Why
PR #21843 removed the TCP websocket app-server listener, but that also
removed functionality that still needs to exist. Restoring it as-is
would reopen the old remote exposure problem, so this keeps the restored
listener while making remote and non-loopback usage require explicit
auth.

## What Changed
- Mostly reverts #21843 and reapplies the small merge-conflict
resolutions needed on top of current main.
- Restores ws://IP:PORT parsing, the app-server TCP websocket acceptor,
websocket auth CLI flags, and the associated tests.
- The only intentional behavior change from the restored code is that
non-loopback websocket listeners now fail startup unless --ws-auth
capability-token or --ws-auth signed-bearer-token is configured.
Loopback listeners remain available for local and SSH-forwarding
workflows.

## Reviewer Focus
Please focus review on the small auth-enforcement delta layered on top
of the revert:

- codex-rs/app-server-transport/src/transport/websocket.rs:
start_websocket_acceptor now rejects unauthenticated non-loopback
websocket binds before accepting connections.
- codex-rs/app-server-transport/src/transport/auth.rs: helper logic
classifies unauthenticated non-loopback listeners.
- codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs:
tests cover unauthenticated ws://0.0.0.0 startup rejection and
authenticated non-loopback capability-token startup.

Everything else is intended to be revert/merge-conflict restoration
rather than new product behavior.

## Verification

- Manually verified that TUI remoting is restored and that auth is
enforced for non-localhost urls.

codex-rs/Cargo.lock

@@ -1922,7 +1922,6 @@ dependencies = [
  "codex-state",
  "codex-thread-store",
  "codex-tools",
- "codex-uds",
  "codex-utils-absolute-path",
  "codex-utils-cargo-bin",
  "codex-utils-cli",
@@ -1931,13 +1930,16 @@ dependencies = [
  "core_test_support",
  "flate2",
  "futures",
+ "hmac",
  "opentelemetry",
  "opentelemetry_sdk",
  "pretty_assertions",
+ "reqwest",
  "rmcp",
  "serde",
  "serde_json",
  "serial_test",
+ "sha2",
  "shlex",
  "tar",
  "tempfile",
@@ -2054,8 +2056,11 @@ dependencies = [
 name = "codex-app-server-transport"
 version = "0.0.0"
 dependencies = [
+ "anyhow",
+ "axum",
  "base64 0.22.1",
  "chrono",
+ "clap",
  "codex-api",
  "codex-app-server-protocol",
  "codex-config",
@@ -2066,12 +2071,18 @@ dependencies = [
  "codex-uds",
  "codex-utils-absolute-path",
  "codex-utils-rustls-provider",
+ "constant_time_eq 0.3.1",
  "futures",
  "gethostname",
+ "hmac",
+ "jsonwebtoken",
+ "owo-colors",
  "pretty_assertions",
  "serde",
  "serde_json",
+ "sha2",
  "tempfile",
+ "time",
  "tokio",
  "tokio-tungstenite",
  "tokio-util",