Surface model provider authentication recovery progress (#41239)

## What changed

- Emit turn-scoped authentication recovery started and completed events when a model provider refreshes expired credentials.
- Add stable `modelProvider/authRecoveryStarted` and `modelProvider/authRecoveryCompleted` app-server notifications with the thread, turn, provider, and user-facing message.
- Show recovery progress in the TUI and `codex exec`, including Amazon Bedrock session reauthentication.

## Testing

- Cover provider recovery success and failure events, app-server routing, client rendering, and Amazon Bedrock credential refresh.

GitOrigin-RevId: 3010c38d0676f18bced27761cf86dd38344d09f9

codex-rs/tui/src/chatwidget/protocol.rs

@@ -152,6 +152,14 @@ impl ChatWidget {
             ServerNotification::ModelSafetyBufferingUpdated(notification) => {
                 self.on_model_safety_buffering_updated(notification, replay_kind)
             }
+            ServerNotification::AuthRecoveryStarted(notification) => {
+                self.add_info_message(notification.message, /*hint*/ None)
+            }
+            ServerNotification::AuthRecoveryCompleted(notification) => {
+                self.add_plain_history_lines(vec![
+                    vec!["✓ ".green(), notification.message.into()].into(),
+                ]);
+            }
             ServerNotification::Warning(notification) => self.on_warning(notification.message),
             ServerNotification::GuardianWarning(notification) => {
                 if !notification