feat: add Bedrock API key as a managed auth mode

[celia-oai]

Why

Codex needs to manage Amazon Bedrock API key credentials through the existing auth lifecycle instead of introducing a separate auth manager or provider-specific credential file. Treating Bedrock API key login as a primary auth mode gives it the same persistence, keyring, reload, and logout behavior as the existing OpenAI API key and ChatGPT modes.

The credential is valid only for the amazon-bedrock model provider. OpenAI-compatible providers must reject this auth mode rather than treating the Bedrock key as an OpenAI bearer token.

What changed

• Added bedrockApiKey as an app-server AuthMode and CodexAuth::BedrockApiKey as a primary AuthManager mode.
• Added BedrockApiKeyAuth, containing the API key and AWS region, to the existing AuthDotJson payload stored in $CODEX_HOME/auth.json or the configured keyring backend.
• Added login_with_bedrock_api_key(...), parallel to login_with_api_key(...), which replaces the current stored login with Bedrock credentials.
• Reused generic auth reload and logout behavior instead of adding a Bedrock-specific auth manager or logout path.
• Updated login restrictions, status reporting, diagnostics, telemetry classification, generated app-server schemas, and auth fixtures for the new mode.
• Added explicit errors when Bedrock API key auth is selected with an OpenAI-compatible model provider.

This PR establishes managed storage and auth-mode behavior. Routing the managed key and region into Amazon Bedrock requests will be in follow-up PRs.

[celia-oai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1cd7a69b77

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".