fix(auth): support OpenAI OAuth vision in Peekaboo

[scotthuang]

Summary

• treat a refreshable OpenAI OAuth session as available when the current access token has expired
• keep OAuth access tokens and expiry timestamps paired by credential source
• bump Tachikoma to the Codex OAuth Responses vision implementation
• document OpenAI OAuth support for Peekaboo image analysis and agent vision

Dependency

Important

Depends on openclaw/Tachikoma#40. This PR is ready for review, but must be merged only after that dependency lands and the Tachikoma submodule pointer is confirmed against the upstream commit.

Root cause

Peekaboo already passes captured images to Tachikoma in a provider-neutral format, but its OpenAI availability gate only accepted a currently valid access token. An expired access token with a usable refresh token therefore made OpenAI appear unavailable before Tachikoma could refresh the OAuth session and send the image through the Codex Responses transport.

User impact

After the Tachikoma dependency lands, users authenticated through peekaboo config login openai can use OpenAI OAuth for see --analyze, image --analyze, and agent vision without configuring a separate OpenAI API key.

Validation

• /usr/bin/arch -arm64 /usr/bin/swift test --package-path Core/PeekabooCore -Xswiftc -DPEEKABOO_SKIP_AUTOMATION --filter ConfigurationAccessorsOAuthTests — 14 tests passed
• git diff --check
• SwiftFormat and SwiftLint were not available in the local environment

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(auth): support OpenAI OAuth vision in Peekaboo This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.