Support dynamic bearer token refresh for custom model providers

What variant of Codex are you using?

CLI

What feature would you like to see?

Codex CLI needs to support dynamic auth token refresh for custom model providers, especially for providers configured with requires_openai_auth = false.

Today, the available options are:

• env_key
• experimental_bearer_token

That is not enough for enterprise-style providers that use short-lived bearer tokens given those are static.
The missing capability is a way to resolve a provider token dynamically, cache it in memory for a configurable interval, and refresh it once on HTTP 401 before retrying the request.

Perhaps something around those lines could be useful:

  auth_token_command = "/some/path/generate-token"
  auth_token_refresh_interval_ms = 300000
  auth_token_refresh_on_401 = true
  auth_token_command_timeout_ms = 5000

Additional information

_No response_