Add provider-owned authentication recovery (#39274)

## What changed

- Let model providers identify recoverable authentication errors and refresh their own authentication state before falling back to `AuthManager` recovery.
- Apply provider recovery to both HTTP and WebSocket response requests, with at most one provider-owned recovery attempt per request.
- Preserve existing `401 Unauthorized` handling as the default for providers that do not customize recovery.

## Testing

- Add coverage for successful and failed provider recovery, including the single-attempt bound and preservation of the original unauthorized error.

GitOrigin-RevId: 9a737e3be96354699586f97dd88e544a45082969

codex-rs/model-provider/src/lib.rs

@@ -23,6 +23,7 @@ pub use provider::ProviderAccountError;
 pub use provider::ProviderAccountResult;
 pub use provider::ProviderAccountState;
 pub use provider::ProviderCapabilities;
+pub use provider::ProviderUnauthorizedRecovery;
 pub use provider::RemoteCompactionSupport;
 pub use provider::SharedModelProvider;
 pub use provider::create_model_provider;