fix(desktop): route Codex OAuth through active proxy

[iMLe0n]

Summary

• route Codex OAuth authorization-code exchange and token refresh through Maka active-proxy-aware fetch
• preserve injected fetch implementations for tests and callers
• update the regression contract so the service cannot silently fall back to Electron global fetch

Closes #1301

Verification

• npm --workspace @maka/desktop test — 2752 passed, 0 failed
• npm --workspace @maka/desktop run typecheck
• npm --workspace @maka/runtime run typecheck
• npx biome lint on both changed files
• focused Codex OAuth tests with coverage — 13 passed; helper coverage 89.39% lines / 82.50% branches / 80% functions
• Electron run-as-node local proxy probe — proxyHit true, HTTP 200

[Astro-Han]

LGTM!