feat: prefer managed Bedrock auth in model provider

[celia-oai]

Why

The Amazon Bedrock model provider currently discards the shared AuthManager, so a Codex-managed Bedrock API key cannot reach request-time provider auth. Bedrock instead falls through to AWS environment or SDK credentials, and the request endpoint can be resolved from a different region than the managed credential.

Managed Bedrock login should control both the bearer credential and Mantle region. Unrelated OpenAI or ChatGPT credentials must remain isolated from Bedrock.

What changed

• Pass the shared AuthManager into AmazonBedrockModelProvider.
• Select CodexAuth::BedrockApiKey before the existing AWS_BEARER_TOKEN_BEDROCK and AWS SDK/SigV4 paths.
• Use the managed Bedrock auth region when resolving the Mantle endpoint.
• Filter other CodexAuth variants so OpenAI and ChatGPT auth are not exposed to Bedrock request auth or unauthorized recovery.
• Add focused coverage for provider construction, managed-auth precedence, bearer headers, endpoint selection, and OpenAI-auth isolation.