[codex] Sanitize OpenCode DB strings

[graykode]

This hardens the OpenCode collector's DB ingestion path.

What changed:

• Strips terminal control and bidi characters from DB-sourced display fields before they reach the TUI or JSON snapshot.
• Keeps title redaction for known secret prefixes through a dedicated helper.
• Applies the same sanitization to model/provider strings loaded from the model lookup query.
• Adds tests for control-character removal and title secret redaction.

Why:
OpenCode session metadata is local data, but it is still rendered in terminal UI and exposed through snapshots. Sanitizing these DB-sourced strings keeps the collector aligned with the defensive handling used elsewhere.

Validation:

• cargo build
• cargo clippy --all-targets -- -D warnings
• cargo test