[codex] Scope managed Bedrock auth cache by provider

[celia-oai]

Why

Managed Amazon Bedrock API keys are persisted in the same durable auth store as general Codex credentials, but they need an independent cache and reload lifetime. A single cached auth slot couples Bedrock credential updates to the general auth snapshot: replacing the persisted record with Bedrock credentials can cause a generic auth reload to discard the OpenAI credentials already held by a loaded session.

This is the first PR in the Phase 1 provider-scoped auth stack. It keeps managed Bedrock credentials represented as CodexAuth::BedrockApiKey, while establishing the cache and provider boundaries needed for later PRs to add managed Bedrock login/logout APIs without changing credentials underneath existing sessions. It does not add a new user-facing login flow by itself.

What changed

• Split AuthManager's in-memory state into general and managed Bedrock cache slots, with Bedrock-specific persistence and reload paths that leave cached general auth untouched.
• Keep BedrockApiKeyAuth in CodexAuth and have the Amazon Bedrock provider expose managed credentials as CodexAuth::BedrockApiKey.
• Exclude persisted Bedrock records from the general auth loading path while continuing to enforce configured login restrictions against them.
• Snapshot managed credentials when constructing the Amazon Bedrock model provider so existing providers keep a stable credential view.
• Resolve account and login status through the active model provider.
• Redact managed Bedrock API keys from Debug output.
• Add coverage for independent cache loading/reloading, provider credential snapshots, Bedrock CodexAuth reporting, and API-key redaction.

Validation

• just test -p codex-login
• just test -p codex-model-provider
• just test -p codex-cli
• Scoped Clippy checks for the affected crates

Stack

1. #31324 Provider-scoped auth foundation — base: main
2. #31327 Managed Bedrock experimental API — base: codex/provider-auth-foundation
3. #31326 Managed Bedrock login — base: codex/managed-bedrock-api
4. #31325 Managed Bedrock logout — base: codex/managed-bedrock-login-v2