[codex] add experimental managed Amazon Bedrock login and logout

[celia-oai]

Why

After #27751, account/read can report whether Amazon Bedrock is using AWS-managed credentials or a Codex-managed API key, but app-server clients still have no matching way to create or remove that managed credential.

This PR adds an experimental managed Amazon Bedrock login/logout flow so app-server clients can onboard Bedrock users without treating a Bedrock API key as general OpenAI authentication. Bedrock credentials stay provider-scoped, while account reporting, request telemetry, CLI status, and diagnostics use the auth mode reported by the active model provider.

What changed

• Add the experimental amazonBedrock variant to v2 account/login/start, including generated JSON and TypeScript schema updates.
• Require the experimentalApi initialization capability for managed Bedrock login. The parameterless account/logout remains available as a best-effort cleanup path for clients that cannot use the experimental login method.
• Trim and validate the API key and Mantle region before changing persisted state, reject managed Bedrock login when external ChatGPT auth is active or ChatGPT login is forced, and allow it when API-key login is forced.
• Persist the Bedrock API key and region in the configured auth store, reload the AuthManager cache, and keep the credential separate from CodexAuth. General API-key login clears a previously stored Bedrock credential.
• Write model_provider = "amazon-bedrock" to the user config after login. Logout removes managed Bedrock credentials and clears that user-layer provider only when it still points to amazon-bedrock, preserving a provider value changed after login.
• Report bedrockApiKey through account/updated and report credentialSource: "codexManaged" through account/read. An app-server already configured for Bedrock reflects transitions between Codex-managed and AWS-managed credentials without a restart.
• Keep AWS-managed Bedrock logout as a no-op so external AWS credentials, OpenAI auth, and provider config are preserved.
• Route request telemetry, codex login status, and codex doctor through provider-reported auth mode so managed Bedrock is visible without exposing its API key through the general OpenAI auth path.
• Document the experimental API behavior in codex-rs/app-server/README.md.

A running session whose active provider is not Bedrock does not live-switch model providers after the config write; a new app-server session or restart picks up the persisted provider. The auth and config writes are also not transactional, so cross-store rollback remains follow-up work.

Verification

• just test -p codex-app-server-protocol
• just test -p codex-login
• just test -p codex-model-provider
• App-server v2 account integration coverage for managed Bedrock login/logout, capability gating, invalid input, provider overrides, notifications, persistence, and AWS-managed fallback

[github-actions]

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.