- Add Codex live handlers for unsupported translation/transcription/SIP endpoints, returning standardized `realtime_capability_not_supported` errors. - Implement `HandleHangup` to validate call ownership, select/refresh pinned OAuth credentials, forward hangup requests to upstream, and complete local session on success. - Add ephemeral client-secret infrastructure for local ephemeral auth: create/authenticate endpoints, token storage with expiry/capacity limits, session normalization/model mapping, and unified realtime error handling. Closes: #4726