[codex] Implement managed Bedrock logout

[celia-oai]

Why

Managed Bedrock API keys are primary CodexAuth values and can use the existing generic logout path. AWS-managed Bedrock credentials are different: they live outside Codex, and logging out while that provider is active must not delete an unrelated stored OpenAI or ChatGPT login.

Logout also needs to remove the user-level Bedrock provider default without overwriting a concurrent config change.

What changed

• Detect managed Bedrock logout from the current cached CodexAuth::BedrockApiKey value.
• Use the existing generic AuthManager::logout_with_revoke path for managed Bedrock auth.
• Clear the user-level model_provider only when it is still "amazon-bedrock", using the config-layer version as a compare-and-set guard.
• Make logout a no-op when the active Bedrock provider is using the external AWS credential chain.
• Preserve unrelated OpenAI auth and provider config in the AWS-managed case.
• Emit account updates from the resulting primary auth state.
• Add integration coverage for managed logout, AWS-managed no-op behavior, config preservation, and logout without the experimental login capability.

Impact

Logging out of Codex-managed Bedrock removes the primary Bedrock credential and safely clears the persisted Bedrock default. AWS SDK-chain credentials remain untouched.

Validation

• just test -p codex-app-server -E 'test(/suite::v2::account/)' — 40 passed
• just fix -p codex-app-server -p codex-app-server-protocol -p codex-model-provider

Stack

1. [codex] Add managed Bedrock login API #31327 Managed Bedrock experimental API — base: main
2. [codex] Implement managed Bedrock login #31326 Managed Bedrock login — base: codex/managed-bedrock-api
3. [codex] Implement managed Bedrock logout #31325 Managed Bedrock logout — base: codex/managed-bedrock-login-v2