[codex] Tighten cloud task backend handling

[bookholt-oai]

Summary

• Tighten backend URL handling for cloud-task flows.
• Keep cloud-task request setup aligned with approved service origins.
• Add focused regression coverage for URL normalization and origin checks.

Validation

• cargo test -p codex-client -p codex-cloud-tasks
• cargo test -p codex-app-server get_account_rate_limits_returns_snapshot -- --nocapture
• /tmp/cargo-tools/bin/just fix -p codex-client
• /tmp/cargo-tools/bin/just fix -p codex-cloud-tasks

The repo-wide Bazel-backed just argument-comment-lint wrapper was attempted twice in this sandbox and failed during Bazel server startup with Cannot get start time of process ...; the scoped packaged linter path completed successfully earlier in this thread.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[bookholt-oai]

recheck