fix(codex-config): close whole-branch review defects in the Codex panel

Plugins/marketplaces GET routes were silently empty because codex-cli.js
never unwrapped the CLI's {installed,available}/{marketplaces} objects
into arrays; backup writes bypassed the symlink-escape guard entirely;
readFileSafe was stricter than every other Codex reader, showing a
symlinked skill/rule in the list and then refusing to open it;
marketplaceAdd only accepted http(s) URLs, rejecting owner/repo sources
the CLI itself takes. Also: docs drift, a dead i18n key, and a scope-cast
hazard in the shared Editor/ConfirmDelete modals.

Fixes, one per finding: unwrap installed/marketplaces in codex-cli.js so
every list route keeps returning a bare list; guard the backup path in
codex-mutate.js with the same assertNotSymlinkEscape the write path
already used (Claude's cc-mutate.js has no such guard on its primary
write path either, so left untouched there); relax readFileSafe's
containment to lexical-only, matching the other four Codex readers,
while leaving the write side's realpath check untouched; reuse
cc-plugin-cli's assertSource for marketplaceAdd instead of a third
validator (ssh remains out of scope, no credential story for it yet).

Server: 1557/1557 (was 1548). Client: tsc -b clean, 469/469 tests.

client/src/i18n/locales/en/codexConfig.json

@@ -32,8 +32,7 @@
   "common": {
     "search": "Search by name…",
     "clearSearch": "Clear search",
-    "close": "Close",
-    "empty": "Nothing here yet."
+    "close": "Close"
   },
   "list": {
     "newButton": "New",

client/src/i18n/locales/vi/codexConfig.json

@@ -32,8 +32,7 @@
   "common": {
     "search": "Tìm theo tên…",
     "clearSearch": "Xóa tìm kiếm",
-    "close": "Đóng",
-    "empty": "Chưa có gì ở đây."
+    "close": "Đóng"
   },
   "list": {
     "newButton": "Mới",