Fix ChatGPT login: extract new device-code format and strip ANSI

[hostomani]

What does this PR do?

Fixes the Login with ChatGPT device-code flow, which had two user-visible bugs caused by one root issue.

The Codex CLI (v0.139.0) now emits the one-time code in a 4-then-5 format (IL70-LNADU), but _CODE_RE only matched 4-4. Because the capture loop exits early only once it has matched both a URL and a code:

• the code never matched → the loop always burned the full _LOGIN_CAPTURE_S = 15s ceiling → the verification page took ~15s to open;
• with no code extracted, the UI fell back to dumping raw CLI stdout (including ANSI escapes) → the code rendered as garbled [90m…[94m… text.

Fix

• Widen _CODE_RE to {3,8}-{3,8} (accepts the new and future formats).
• Add _ANSI_RE and strip escapes before matching — including inside the capture loop. This is essential: the CLI wraps the code in \x1b[94m…, whose trailing m defeats the \b boundary and would keep the early-exit from firing even with the widened regex.
• Tests in tests/test_login_parse.py pin extraction (new + legacy formats, ANSI stripping, and a regression guard that the code only matches after stripping).

No auth-method change — ChatGPT device-auth only, engine references untouched. No JS/template/schema change.

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / chore

Checklist

• Targets Odoo 18.0 and follows the existing code style
• Added/updated tests under tests/ (tagged codexoo)
• Updated CHANGELOG.md (bullet under ## [Unreleased])
• Updated SECURITY.md if this touches a safety-critical path (else N/A) — N/A: only the device-code/URL display parsing in res_users.py changed; no tool endpoint, SQL guard, bridge token, or auth invariant is affected.
• All commits are signed off (git commit -s → DCO)
• I am the author and have reviewed/understand all code here, including any AI-assisted parts, and it is mine to license
• Tool endpoints still run as the user, never superuser
• Did not alter Codex engine references (ChatGPT/device-code login, CODEX_HOME, CLI glob, codex_thread_id / codex_item_id)
• For security-sensitive changes: invariants in SECURITY.md are preserved

🤖 Generated with Claude Code