[codex] add experimental managed Amazon Bedrock login and logout

[celia-oai]

Why

The provider-scoped auth stack can report whether Amazon Bedrock is using a Codex-managed API key, but app-server clients still cannot establish or remove that managed credential. This adds an experimental persistence-only account flow while deliberately leaving runtime provider and auth reloading to a later change.

Depends on #27751.

Stack: #27443 → #27689 → #27751 → this PR.

What changed

• add an experimental amazonBedrock variant to v2 account/login/start, including API key and region validation
• require the experimentalApi initialization capability for managed Bedrock login and logout
• persist the Bedrock API key and write model_provider = "amazon-bedrock" to the active user config before returning
• require restart for login and logout to affect runtime account state, sessions, history filters, notifications, or inference
• remove managed Bedrock auth on logout and clear the user-layer provider only while its value is still amazon-bedrock
• keep AWS-managed Bedrock logout as a no-op
• document the experimental and restart-only behavior

The auth and config writes are intentionally not transactional in this scoped change. Runtime provider/config reload and cross-store rollback are left for follow-up work.

Test plan

• just test -p codex-app-server-protocol
• just test -p codex-app-server
• just test -p codex-login
• just test -p codex-model-provider