config: own layer provenance types (#29722)

## Why

Config layer provenance describes how effective configuration was
assembled, so it belongs with the config loader rather than in
app-server's serialized API types.

## What changed

- Moved `ConfigLayerSource`, `ConfigLayerMetadata`, and `ConfigLayer`
ownership into `codex-config`.
- Kept app-server's wire payloads unchanged and added explicit
conversions at the app boundary.
- Removed lower-level app-server-protocol dependencies from config
consumers.

## Stack

This is PR 3 of 6, stacked on [PR
#29721](https://github.com/openai/codex/pull/29721). Review only the
delta from `codex/split-auth-domain-types`. Next: [PR
#29723](https://github.com/openai/codex/pull/29723).

## Validation

- `codex-config` coverage passed.
- App-server config-manager and config RPC coverage passed.

codex-rs/config/src/config_layer_source.rs

@@ -1,4 +1,76 @@
-use codex_app_server_protocol::ConfigLayerSource;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use serde_json::Value as JsonValue;
+
+/// Provenance for one layer in the effective Codex configuration.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ConfigLayerSource {
+    /// Managed preferences delivered by MDM.
+    Mdm { domain: String, key: String },
+    /// Host-wide configuration loaded from a file.
+    System { file: AbsolutePathBuf },
+    /// Configuration delivered by an enterprise cloud bundle.
+    EnterpriseManaged { id: String, name: String },
+    /// User configuration, optionally augmented by a selected profile.
+    User {
+        file: AbsolutePathBuf,
+        profile: Option<String>,
+    },
+    /// Configuration loaded from a project's `.codex` directory.
+    Project { dot_codex_folder: AbsolutePathBuf },
+    /// Overrides supplied for the current session.
+    SessionFlags,
+    /// Legacy managed configuration loaded from a file.
+    LegacyManagedConfigTomlFromFile { file: AbsolutePathBuf },
+    /// Legacy managed configuration delivered by MDM.
+    LegacyManagedConfigTomlFromMdm,
+}
+
+impl ConfigLayerSource {
+    /// A setting from a layer with a higher precedence overrides a setting
+    /// from a layer with a lower precedence.
+    pub fn precedence(&self) -> i16 {
+        match self {
+            ConfigLayerSource::Mdm { .. } => 0,
+            ConfigLayerSource::System { .. } => 10,
+            ConfigLayerSource::EnterpriseManaged { .. } => 15,
+            ConfigLayerSource::User { profile, .. } => {
+                if profile.is_some() {
+                    21
+                } else {
+                    20
+                }
+            }
+            ConfigLayerSource::Project { .. } => 25,
+            ConfigLayerSource::SessionFlags => 30,
+            ConfigLayerSource::LegacyManagedConfigTomlFromFile { .. } => 40,
+            ConfigLayerSource::LegacyManagedConfigTomlFromMdm => 50,
+        }
+    }
+}
+
+/// Compares [`ConfigLayerSource`] by precedence, so `A < B` means settings
+/// from layer `A` will be overridden by settings from layer `B`.
+impl PartialOrd for ConfigLayerSource {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.precedence().cmp(&other.precedence()))
+    }
+}
+
+/// Identity and version information for a configuration layer.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ConfigLayerMetadata {
+    pub name: ConfigLayerSource,
+    pub version: String,
+}
+
+/// A materialized configuration layer and its provenance.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ConfigLayer {
+    pub name: ConfigLayerSource,
+    pub version: String,
+    pub config: JsonValue,
+    pub disabled_reason: Option<String>,
+}
 
 pub fn format_config_layer_source(source: &ConfigLayerSource, config_toml_file: &str) -> String {
     match source {