[codex] Add managed Bedrock login API

[celia-oai]

Summary

This is PR 2 of 4 for Phase 1 of the provider-scoped auth design, split from #28148.

• add the experimental amazonBedrock variant to account/login/start
• accept an API key and AWS region and return a matching discriminated response
• gate the request behind the app-server experimentalApi capability
• regenerate JSON and TypeScript protocol schemas
• document the login contract, notifications, restart boundary, and non-transactional durable writes

Why

Keeping the wire contract separate from implementation makes the experimental API shape and generated schema changes reviewable on their own.

Impact

This PR defines the API but does not implement the login behavior. The next PR adds validation, persistence, provider selection, and notifications.

Validation

• just test -p codex-app-server-protocol — 252 tests passed
• just fmt

Stack

1. #31324 Provider-scoped auth foundation — base: main
2. #31327 Managed Bedrock experimental API — base: codex/provider-auth-foundation
3. #31326 Managed Bedrock login — base: codex/managed-bedrock-api
4. #31325 Managed Bedrock logout — base: codex/managed-bedrock-login-v2