[Bedrock] Support refreshable AWS credentials and provider-native login

Summary

Codex's Amazon Bedrock setup should support provider-native, refreshable AWS authentication rather than requiring users to manually manage a bearer token and provider config.

This consolidates three independent requests from Bedrock dogfooding:

• refresh AWS credentials automatically (including enterprise SSO scenarios)
• add a dedicated codex login --bedrock / codex login --aws flow
• expose Bedrock as a first-class provider in app onboarding instead of requiring manual environment variables and config.toml edits

Problem

The current setup creates several adoption and reliability problems:

• short-lived credentials expire and need manual replacement
• enterprise users expect the standard AWS credential chain and SSO refresh behavior
• CLI and app onboarding are error-prone because provider selection, region, model, and credentials are configured separately
• logout and provider-switching behavior can be confusing when Bedrock credentials remain in the environment

Proposed behavior

1. Support the standard AWS credential chain, including AWS_PROFILE, SSO/credential_process, environment credentials, and automatic refresh.
2. Add a provider-native CLI login/setup flow such as codex login --bedrock.
3. Add Amazon Bedrock to the app's provider selector with guided region and credential setup.
4. Document the supported credential types, refresh behavior, precedence, and logout/provider-switching semantics.

Acceptance criteria

• A user can authenticate to Bedrock without manually copying a short-lived bearer token into multiple config locations.
• Refreshable credentials renew during a long-running Codex session without restarting Codex.
• CLI and app diagnostics identify which AWS credential source and region are active without printing secrets.
• Switching away from Bedrock or logging out produces predictable behavior.
• Existing AWS_BEARER_TOKEN_BEDROCK configurations continue to work.

Notes

This is intentionally scoped to authentication and onboarding. Model compatibility and provider-response bugs should remain separate issues.