chore(deps): bump provider pins, remove unused ws devDep

codex-provider 0.1.2 adds a bundled-models constant; oauth-core 0.3.0
adds RFC 8707 resource passthrough and 401-challenge discovery while
keeping every consumer symbol intact (refresh signature narrows to a
Pick — acceptance-widening). Wire behavior for our providers is
byte-identical (no resource configured). The peer range declared by
codex-provider (0.2.x) lags these additions; upstream should widen it.
ws had zero first-party imports and leaves the tree.

Author: TheGreatAxios

bun.lock

@@ -87,8 +87,8 @@
     "tar": "^7.5.1"
   },
   "dependencies": {
-    "@corbits/codex-provider": "0.1.1",
-    "@corbits/oauth-core": "0.2.0",
+    "@corbits/codex-provider": "0.1.2",
+    "@corbits/oauth-core": "0.3.0",
     "@corbits/openai-responses": "0.2.1",
     "@corbits/xai-provider": "0.1.2",
     "@intx/agent": "workspace:*",
@@ -122,8 +122,7 @@
     "oxfmt": "^0.73.0",
     "oxlint": "^1.88.0",
     "typescript": "5.9.3",
-    "typescript-language-server": "^4.3.4",
-    "ws": "^8.21.0"
+    "typescript-language-server": "^4.3.4"
   },
   "optionalDependencies": {
     "@opentui/core-darwin-arm64": "0.5.12",