feat(settings): Codex Bağlama, on by default

Settings → Codex Bağlama runs the bundled bridge for an OpenAI Codex install on
the same computer: the IDE's models and combos appear in Codex and switching
models keeps the conversation. The IDE points Codex's openai_base_url at the
bridge only after the bridge answers, keeps it running across logins, and
removes every trace when the setting is turned off. A Codex that already uses
another base URL is left untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HRDGW1LiKcDUZYUdKBoWYW

apps/desktop/src/global.d.ts

@@ -1,6 +1,7 @@
 import type { GatewayWsUrlResult } from '@hermes/shared'
 import type { TranslucencyState } from '@hermes/shared/translucency'
 
+import type { CodexLinkPatch, CodexLinkStatus } from '../electron/codex-link-types'
 import type { PoolLimits } from '../electron/pool-limits'
 
 import type { WakeIndicatorState } from './lib/wake-indicator'
@@ -335,6 +336,13 @@ declare global {
       aiturkMobile?: {
         open: () => Promise<{ ok: true }>
       }
+      /** "Codex Bağlama" (electron/codex-link.ts): lets the Codex on this machine
+       *  use the IDE's models. `get` only reads; `set` applies and returns the
+       *  state that actually resulted. Windows only. */
+      codexLink?: {
+        get: () => Promise<CodexLinkStatus>
+        set: (patch: CodexLinkPatch) => Promise<CodexLinkStatus>
+      }
       /** One-shot loopback callback listener for MCP OAuth against remote
        *  backends (electron/mcp-oauth-callback-ipc.ts): bind on THIS machine,
        *  pass redirectUri as client_redirect_uri to mcp.servers.oauth.start,