- Introduce explicit per-refresh request timeouts in Codex and Claude OAuth token refresh logic. - Ensure refresh flows use `context.WithTimeout` with `context.WithoutCancel` to avoid inheriting caller cancellation and avoid hanging refresh calls. - Add a dedicated Claude TLS handshake timeout for utls transport creation via request context and enforce it by setting connection deadlines during handshake. Closes: #4712