Fix ChatGPT login: extract new device-code format and strip ANSI (17.0)

[hostomani]

What does this PR do?

Ports #7 (merged to 18.0) to 17.0. Fixes the Login with ChatGPT device-code flow, which had two user-visible bugs caused by one root issue.

The Codex CLI (v0.139.0) now emits the one-time code in a 4-then-5 format (IL70-LNADU), but _CODE_RE only matched 4-4. Because the capture loop exits early only once it has matched both a URL and a code:

• the code never matched -> the loop always burned the full _LOGIN_CAPTURE_S = 15s ceiling -> the verification page took ~15s to open;
• with no code extracted, the UI fell back to dumping raw CLI stdout (including ANSI escapes) -> the code rendered as garbled [90m...[94m... text.

Fix

• Widen _CODE_RE to {3,8}-{3,8} (accepts the new and future formats).
• Add _ANSI_RE and strip escapes before matching — including inside the capture loop. This is essential: the CLI wraps the code in \x1b[94m..., whose trailing m defeats the \b boundary and would keep the early-exit from firing even with the widened regex.
• Tests in tests/test_login_parse.py pin extraction (new + legacy formats, ANSI stripping, and a regression guard that the code only matches after stripping).

No auth-method change — ChatGPT device-auth only, engine references untouched. No JS/template/schema change.

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / chore

Checklist

• Targets Odoo 17.0 and follows the existing code style
• Added/updated tests under tests/ (tagged codexoo)
• Updated CHANGELOG.md (bullet under ## [Unreleased])
• Updated SECURITY.md if this touches a safety-critical path (else N/A) — N/A: only the device-code/URL display parsing in res_users.py changed; no tool endpoint, SQL guard, bridge token, or auth invariant is affected.
• All commits are signed off (git commit -s -> DCO)
• I am the author and have reviewed/understand all code here, including any AI-assisted parts, and it is mine to license
• Tool endpoints still run as the user, never superuser
• Did not alter Codex engine references (ChatGPT/device-code login, CODEX_HOME, CLI glob, codex_thread_id / codex_item_id)
• For security-sensitive changes: invariants in SECURITY.md are preserved

Testing

Ran the codexoo suite locally (--test-tags codexoo --workers 0): the 5 new TestLoginParse cases pass. One unrelated failure (TestIrHttpAuth.test_valid_bearer_runs_as_user, bridge-token HTTP auth) is pre-existing on 17.0 and independent of this change (verified by running the suite on a clean checkout).

🤖 Generated with Claude Code