feat: add opt-in provider runtime abstraction (#17713)

## Summary

- Add `codex-model-provider` as the runtime home for model-provider
behavior that does not belong in `codex-core`, `codex-login`, or
`codex-api`.
- The new crate wraps configured `ModelProviderInfo` in a
`ModelProvider` trait object that can resolve the API provider config,
provider-scoped auth manager, and request auth provider for each call.
- This centralizes provider auth behavior in one place today, and gives
us an extension point for future provider-specific auth, model listing,
request setup, and related runtime behavior.

## Tests
Ran tests manually to make sure that provider auth under different
configs still work as expected.

---------

Co-authored-by: pakrym-oai <pakrym@openai.com>

codex-rs/codex-api/src/endpoint/models.rs

@@ -1,4 +1,4 @@
-use crate::auth::AuthProvider;
+use crate::auth::SharedAuthProvider;
 use crate::endpoint::session::EndpointSession;
 use crate::error::ApiError;
 use crate::provider::Provider;
@@ -11,12 +11,12 @@ use http::Method;
 use http::header::ETAG;
 use std::sync::Arc;
 
-pub struct ModelsClient<T: HttpTransport, A: AuthProvider> {
-    session: EndpointSession<T, A>,
+pub struct ModelsClient<T: HttpTransport> {
+    session: EndpointSession<T>,
 }
 
-impl<T: HttpTransport, A: AuthProvider> ModelsClient<T, A> {
-    pub fn new(transport: T, provider: Provider, auth: A) -> Self {
+impl<T: HttpTransport> ModelsClient<T> {
+    pub fn new(transport: T, provider: Provider, auth: SharedAuthProvider) -> Self {
         Self {
             session: EndpointSession::new(transport, provider, auth),
         }
@@ -76,6 +76,7 @@ impl<T: HttpTransport, A: AuthProvider> ModelsClient<T, A> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::auth::AuthProvider;
     use crate::provider::RetryConfig;
     use async_trait::async_trait;
     use codex_client::Request;
@@ -165,7 +166,7 @@ mod tests {
         let client = ModelsClient::new(
             transport.clone(),
             provider("https://example.com/api/codex"),
-            DummyAuth,
+            Arc::new(DummyAuth),
         );
 
         let (models, _) = client
@@ -229,7 +230,7 @@ mod tests {
         let client = ModelsClient::new(
             transport,
             provider("https://example.com/api/codex"),
-            DummyAuth,
+            Arc::new(DummyAuth),
         );
 
         let (models, _) = client
@@ -256,7 +257,7 @@ mod tests {
         let client = ModelsClient::new(
             transport,
             provider("https://example.com/api/codex"),
-            DummyAuth,
+            Arc::new(DummyAuth),
         );
 
         let (models, etag) = client