[codex] expose Bedrock credential source in account/read

[celia-oai]

Why

account/read currently reports only type: "amazonBedrock", so clients cannot distinguish a Codex-managed Bedrock API key from credentials supplied by AWS. The app UI needs that distinction to render the appropriate account state without duplicating provider-auth logic.

Credential-source selection belongs to the Bedrock model provider because it already owns the precedence between managed Bedrock auth and the external AWS credential path. This builds on #27443 and #27689.

What changed

• Added AmazonBedrockCredentialSource with codexManaged and awsManaged values.
• Included the selected credential source in ProviderAccount::AmazonBedrock and the app-server Account response.
• Made AmazonBedrockModelProvider::account_state() classify the source from its managed-auth state.
• Regenerated the app-server JSON and TypeScript schemas.
• Updated app-server account documentation and downstream TUI matches.

codexManaged means the provider found a managed Bedrock API key. awsManaged identifies the provider's external AWS credential path; it does not assert that the AWS credential chain has been validated.

Testing

• Added model-provider coverage for Codex-managed precedence and AWS-managed fallback.
• Added app-server protocol serialization coverage for both wire values.
• Added app-server integration coverage for both account/read responses.
• just test -p codex-protocol -p codex-model-provider -p codex-app-server-protocol (497 tests passed).

After rebasing onto #27711, the codex-app-server test target compiled past the image-generation PathUri migration. Local linking was then interrupted by disk exhaustion (No space left on device).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 016482524f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".