feat: add real-time permission and model mode synchronization close #21

Implements bidirectional sync of permission/model modes between CLI sessions and web app. Adds Codex-specific permission modes (read-only, safe-yolo, yolo) alongside Claude's modes. Web can now control CLI session state via RPC set-session-config handler, while CLI broadcasts state changes through keep-alive payloads. UI controls are flavor-aware, showing appropriate modes for Claude vs Codex vs Gemini. Type centralization in api/types eliminates circular dependencies.

cli/src/codex/loop.ts

@@ -24,6 +24,7 @@ interface LoopOptions {
     api: ApiClient;
     codexArgs?: string[];
     codexCliOverrides?: CodexCliOverrides;
+    permissionMode?: PermissionMode;
     onSessionReady?: (session: CodexSession) => void;
 }
 
@@ -43,7 +44,8 @@ export async function loop(opts: LoopOptions): Promise<void> {
         startedBy,
         startingMode,
         codexArgs: opts.codexArgs,
-        codexCliOverrides: opts.codexCliOverrides
+        codexCliOverrides: opts.codexCliOverrides,
+        permissionMode: opts.permissionMode ?? 'default'
     });
 
     if (opts.onSessionReady) {