[codex] Implement managed Bedrock logout

[celia-oai]

Summary

This is PR 4 of 4 for Phase 1 of the provider-scoped auth design, split from #28148.

• remove only stored managed Bedrock auth and clear only the scoped Bedrock cache
• preserve cached general OpenAI auth for existing loaded sessions
• clear the user-level model_provider only when it is still "amazon-bedrock"
• use the config layer version as a compare-and-set guard so concurrent user changes are preserved
• make logout a no-op for AWS-managed Bedrock credentials
• emit account updates based on the active provider after logout
• document managed and AWS-managed logout semantics

Why

Generic logout deletes all durable auth and reloads the full cache. That would incorrectly invalidate an active OpenAI session and could remove credentials that are unrelated to the active Bedrock provider.

Phase 1 needs provider-aware logout even though durable auth remains a singleton.

Impact

Logging out of Codex-managed Bedrock removes the managed key and, when safe, the persisted Bedrock default. AWS SDK-chain credentials remain untouched. Existing loaded OpenAI sessions continue using their cached auth.

Validation

• just test -p codex-login — 154 tests passed
• focused Bedrock app-server suite — 15 tests passed
• scoped just fix -p codex-login -p codex-app-server
• just fmt

Coverage includes managed logout, AWS-managed no-op, concurrent provider-change preservation, provider-aware account reporting, and OpenAI-session continuity through login and logout.

Stack

1. #31324 Provider-scoped auth foundation — base: main
2. #31327 Managed Bedrock experimental API — base: codex/provider-auth-foundation
3. #31326 Managed Bedrock login — base: codex/managed-bedrock-api
4. #31325 Managed Bedrock logout — base: codex/managed-bedrock-login-v2