[codex] Add externally provided Codex auth (#31274)

## Summary

Add an in-memory externally provided Codex auth snapshot with explicit
runtime capabilities, installed through the existing `ExternalAuth`
provider path.

## Testing

- `just fmt-check`
- `cargo test -p codex-login --lib externally_provided_auth`
- `cargo test -p codex-core --lib
external_auth_snapshot_is_installed_from_runtime_config`
- `cargo test -p codex-model-provider --lib external_auth`
- `cargo test -p codex-mcp-extension --test hosted_apps_mcp
hosted_apps_mcp_accepts_external_provided_codex_auth`
- `cargo check -p codex-app-server -p codex-core-api -p
codex-thread-manager-sample`

---------

Co-authored-by: pakrym-oai <pakrym@openai.com>

codex-rs/model-provider/src/auth.rs

@@ -7,6 +7,7 @@ use codex_agent_identity::authorization_header_for_agent_task;
 use codex_api::AgentIdentityTelemetry;
 use codex_api::AuthProvider;
 use codex_api::SharedAuthProvider;
+use codex_login::AuthHeaders;
 use codex_login::AuthManager;
 use codex_login::CodexAuth;
 use codex_login::auth::AgentIdentityAuth;
@@ -109,6 +110,17 @@ impl AuthProvider for AgentIdentityAuthProvider {
     }
 }
 
+#[derive(Clone, Debug)]
+struct HeaderAuthProvider {
+    auth: AuthHeaders,
+}
+
+impl AuthProvider for HeaderAuthProvider {
+    fn add_auth_headers(&self, headers: &mut HeaderMap) {
+        headers.extend(self.auth.headers().clone());
+    }
+}
+
 // Some providers are meant to send no auth headers. Examples include local OSS
 // providers and custom test providers with `requires_openai_auth = false`.
 #[derive(Clone, Debug)]
@@ -243,6 +255,7 @@ pub fn auth_provider_from_auth(auth: &CodexAuth) -> SharedAuthProvider {
         CodexAuth::AgentIdentity(auth) => {
             Arc::new(AgentIdentityAuthProvider { auth: auth.clone() })
         }
+        CodexAuth::Headers(auth) => Arc::new(HeaderAuthProvider { auth: auth.clone() }),
         CodexAuth::BedrockApiKey(_) => unreachable!("{BEDROCK_API_KEY_UNSUPPORTED_MESSAGE}"),
         CodexAuth::ApiKey(_)
         | CodexAuth::Chatgpt(_)
@@ -388,6 +401,21 @@ mod tests {
         assert!(auth.to_auth_headers().is_empty());
     }
 
+    #[test]
+    fn header_auth_adds_predefined_headers() {
+        let mut expected = HeaderMap::new();
+        expected.insert(
+            http::header::AUTHORIZATION,
+            HeaderValue::from_static("Bearer external"),
+        );
+        expected.insert("x-external-auth", HeaderValue::from_static("enabled"));
+        let auth = CodexAuth::Headers(AuthHeaders::new(expected.clone()));
+
+        let actual = auth_provider_from_auth(&auth).to_auth_headers();
+
+        assert_eq!(actual, expected);
+    }
+
     #[test]
     fn openai_provider_rejects_bedrock_api_key_auth() {
         let provider = ModelProviderInfo::create_openai_provider(/*base_url*/ None);