[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/login/src/api_bridge.rs

@@ -1,4 +1,4 @@
-use codex_api::api_bridge::CoreAuthProvider;
+use codex_api::CoreAuthProvider;
 use codex_model_provider_info::ModelProviderInfo;
 
 use crate::CodexAuth;

codex-rs/login/src/lib.rs

@@ -9,6 +9,7 @@ mod pkce;
 mod server;
 
 pub use codex_client::BuildCustomCaTransportError as BuildLoginHttpClientError;
+pub use codex_config::types::AuthCredentialsStoreMode;
 pub use device_code_auth::DeviceCode;
 pub use device_code_auth::complete_device_code_login;
 pub use device_code_auth::request_device_code;