Codex CLI needs a browser for OAuth login. Here’s how to make it work on a headless server using SSH port forwarding — plus why the OAuth token can’t replace an API key.