Support managed AWS access keys for Amazon Bedrock (#40481)

## What changed

- Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests.
- Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup.
- Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched.
- Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect.

## Testing

- Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup.

GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723

codex-rs/core/src/config/edit.rs

@@ -26,6 +26,7 @@ use toml_edit::value;
 
 const NOTICE_TABLE_KEY: &str = "notice";
 
+mod bedrock;
 mod document_helpers;
 
 /// Discrete config mutations supported by the persistence engine.

codex-rs/core/src/config/edit/bedrock.rs

@@ -0,0 +1,37 @@
+use super::ConfigEditsBuilder;
+use crate::config::Config;
+use codex_model_provider_info::AMAZON_BEDROCK_PROVIDER_ID;
+use codex_model_provider_info::AMAZON_BEDROCK_RUNTIME_PROVIDER_ID;
+
+impl ConfigEditsBuilder {
+    /// Return the user config paths to clear for the selected Bedrock provider.
+    pub fn bedrock_provider_config_paths_to_clear(config: &Config) -> Option<Vec<Vec<String>>> {
+        let provider_id = config.model_provider_id.as_str();
+        if !matches!(
+            provider_id,
+            AMAZON_BEDROCK_PROVIDER_ID | AMAZON_BEDROCK_RUNTIME_PROVIDER_ID
+        ) {
+            return None;
+        }
+
+        let user_layer = config.config_layer_stack.get_active_user_layer()?;
+        if user_layer
+            .config
+            .get("model_provider")
+            .and_then(toml::Value::as_str)
+            != Some(provider_id)
+        {
+            return None;
+        }
+
+        Some(vec![
+            vec!["model_provider".to_string()],
+            vec![
+                "model_providers".to_string(),
+                provider_id.to_string(),
+                "aws".to_string(),
+            ],
+            vec!["model".to_string()],
+        ])
+    }
+}