Move auth code into login crate (#15150)

- Move the auth implementation and token data into codex-login.
- Keep codex-core re-exporting that surface from codex-login for
existing callers.

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/login/src/lib.rs

@@ -1,3 +1,6 @@
+pub mod auth;
+pub mod token_data;
+
 mod device_code_auth;
 mod pkce;
 mod server;
@@ -12,15 +15,23 @@ pub use server::ServerOptions;
 pub use server::ShutdownHandle;
 pub use server::run_login_server;
 
-// Re-export commonly used auth types and helpers from codex-core for compatibility
+pub use auth::AuthConfig;
+pub use auth::AuthCredentialsStoreMode;
+pub use auth::AuthDotJson;
+pub use auth::AuthManager;
+pub use auth::CLIENT_ID;
+pub use auth::CODEX_API_KEY_ENV_VAR;
+pub use auth::CodexAuth;
+pub use auth::OPENAI_API_KEY_ENV_VAR;
+pub use auth::REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR;
+pub use auth::RefreshTokenError;
+pub use auth::UnauthorizedRecovery;
+pub use auth::default_client;
+pub use auth::enforce_login_restrictions;
+pub use auth::load_auth_dot_json;
+pub use auth::login_with_api_key;
+pub use auth::logout;
+pub use auth::read_openai_api_key_from_env;
+pub use auth::save_auth;
 pub use codex_app_server_protocol::AuthMode;
-pub use codex_core::AuthManager;
-pub use codex_core::CodexAuth;
-pub use codex_core::auth::AuthDotJson;
-pub use codex_core::auth::CLIENT_ID;
-pub use codex_core::auth::CODEX_API_KEY_ENV_VAR;
-pub use codex_core::auth::OPENAI_API_KEY_ENV_VAR;
-pub use codex_core::auth::login_with_api_key;
-pub use codex_core::auth::logout;
-pub use codex_core::auth::save_auth;
-pub use codex_core::token_data::TokenData;
+pub use token_data::TokenData;