v0.2.12 regression: valid Codex accounts repeatedly marked unauthorized due to refresh_token_invalidated #136

After updating to v0.2.12, multiple accounts that are still fully valid and working in Codex are repeatedly shown as unauthorized in Codex Switcher.

This has already happened twice within one day across all accounts.

The error shown by Codex Switcher is:

Token refresh failed: 401 Unauthorized - {
  "error": {
    "message": "Your session has ended. Please log in again.",
    "type": "invalid_request_error",
    "param": null,
    "code": "refresh_token_invalidated"
  }
}

However, the same accounts remain authenticated and continue to work normally in Codex. So the Switcher UI is reporting them as invalid even though the live Codex sessions are valid.

This looks like a regression introduced by the new auth logic in v0.2.12. In particular, the new code treats an expired or malformed id_token as requiring a token refresh even when the access_token is still valid, and usage fetching calls ensure_chatgpt_tokens_fresh(). That means simply refreshing account usage can trigger OAuth refresh attempts for stored accounts.

For multi-account setups this is risky because refresh tokens are rotated/single-use and the stored token may already be stale compared with the live token currently used by Codex. A failed refresh then marks the account as unauthorized even though the actual Codex session is still healthy.

Expected behavior:

• Do not mark an account unauthorized solely because a stored refresh token fails if the live Codex session/access token is still valid.
• Avoid refreshing OAuth tokens just to fetch usage when the current access token is still accepted.
• Prefer/reconcile live credentials from ~/.codex/auth.json whenever they correspond to the same ChatGPT account.
• A stale/invalidated stored refresh token should not make the UI claim that the whole account is logged out when Codex is still authenticated.

This started immediately after upgrading to v0.2.12 and did not behave this way before.