Harden auth profile switching

[shiny-code-bot]

Summary

• preserve auth profile identity metadata unless new login data replaces it, and clear stale email when account id changes without email
• record actual profile identity after in-TUI /login completes
• rebuild selected-profile config/cloud bundle and prepare the replacement session before switching app-server clients

Tests

• cargo test -p codex-login auth_profiles::tests::record_login
• cargo check -p codex-tui
• cargo fmt --package codex-login --package codex-tui -- --check

Review

• planning agent agreed with prepare-then-commit lifecycle approach
• review agents found metadata/config gaps; fixed and final review returned no issues