refactor(ai-gateway): add Effect account runtime

[robinbraemer]

Advances #105 and #102.

Outcome

• switches the live AI Gateway entrypoint to an Effect-native account store, vault, and ManagedAccountVault layer
• implements OpenAI Codex device-code login and refresh over scoped Effect HttpClient, with bounded responses and typed redacted failures
• preserves private 0700/0600 state, atomic fsync/rename writes, bounded files, cross-process locking, virtual-time retries, and interruption-safe release
• deduplicates refresh across fibers and processes by holding the durable scoped store lock through the Effect refresh transaction
• leaves the legacy Promise service/compaction compatibility graph byte-identical and explicitly baselined for its later full characterization/removal slice

Verification

• bun run check
  • Effect policy: 409 assigned TypeScript paths, zero violations
  • legacy: 529 pass, 4 intentional skips, 0 fail
  • Effect: 260 pass
  • site: 114 pass
  • build, root typecheck, site lint, site typecheck pass
• executable smoke: help created zero state entries; /healthz 200; empty-account /readyz 503; SIGINT scoped shutdown observed and accepted

This does not close #105: the unchanged legacy service/proxy/routing/account compatibility graph and its Promise-era tests remain scheduled migration inventory.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	agentos-site	ba9d12b	Aug 01 2026, 09:27 PM