[codex] Implement managed Bedrock login

[celia-oai]

Summary

This is PR 3 of 4 for Phase 1 of the provider-scoped auth design, split from #28148.

• validate non-empty managed Bedrock API keys and Mantle-supported regions
• reject login under forced ChatGPT policy or active external ChatGPT auth, while allowing forced API policy and Codex environment auth
• persist the managed Bedrock credential, write model_provider = "amazon-bedrock", then publish only the scoped Bedrock cache update
• preserve provider overrides and existing loaded OpenAI sessions
• emit provider-aware login and account notifications
• add app-server integration coverage for policy, validation, persistence, overrides, and the restart boundary

Why

Phase 1 changes the persisted default for future sessions without mutating already-loaded sessions. The ordering here prevents a failed config write from publishing the new Bedrock cache and avoids a generic auth reload that would invalidate cached OpenAI auth.

The auth and config writes remain deliberately non-transactional in Phase 1 and are documented as such.

Impact

Clients with experimentalApi enabled can log in using type: "amazonBedrock". New app-server processes use the persisted Bedrock default; existing loaded sessions retain their original provider.

Validation

• focused app-server Bedrock login tests passed, including policy and existing-session continuity
• just test -p codex-app-server-protocol — 252 tests passed
• scoped Clippy and just fmt

Stack

1. #31324 Provider-scoped auth foundation — base: main
2. #31327 Managed Bedrock experimental API — base: codex/provider-auth-foundation
3. #31326 Managed Bedrock login — base: codex/managed-bedrock-api
4. #31325 Managed Bedrock logout — base: codex/managed-bedrock-login-v2