[codex] expose Bedrock credential source in account/read (#27751)

## Why

`account/read` currently reports only `type: "amazonBedrock"`, so
clients cannot distinguish a Codex-managed Bedrock API key from
credentials supplied by AWS. The app UI needs that distinction to render
the appropriate account state without duplicating provider-auth logic.

Credential-source selection belongs to the Bedrock model provider
because it already owns the precedence between managed Bedrock auth and
the external AWS credential path. This builds on #27443 and #27689.

## What changed

- Added `AmazonBedrockCredentialSource` with `codexManaged` and
`awsManaged` values.
- Included the selected credential source in
`ProviderAccount::AmazonBedrock` and the app-server `Account` response.
- Made `AmazonBedrockModelProvider::account_state()` classify the source
from its managed-auth state.
- Regenerated the app-server JSON and TypeScript schemas.
- Updated app-server account documentation and downstream TUI matches.

`codexManaged` means the provider found a managed Bedrock API key.
`awsManaged` identifies the provider's external AWS credential path; it
does not assert that the AWS credential chain has been validated.

## Testing

- Added model-provider coverage for Codex-managed precedence and
AWS-managed fallback.
- Added app-server protocol serialization coverage for both wire values.
- Added app-server integration coverage for both `account/read`
responses.
- `just test -p codex-protocol -p codex-model-provider -p
codex-app-server-protocol` (497 tests passed).

After rebasing onto #27711, the `codex-app-server` test target compiled
past the image-generation `PathUri` migration. Local linking was then
interrupted by disk exhaustion (`No space left on device`).

codex-rs/model-provider/src/amazon_bedrock/mod.rs

@@ -15,6 +15,7 @@ use codex_model_provider_info::ModelProviderAwsAuthInfo;
 use codex_model_provider_info::ModelProviderInfo;
 use codex_models_manager::manager::SharedModelsManager;
 use codex_models_manager::manager::StaticModelsManager;
+use codex_protocol::account::AmazonBedrockCredentialSource;
 use codex_protocol::account::ProviderAccount;
 use codex_protocol::error::Result;
 use codex_protocol::openai_models::ModelsResponse;
@@ -130,8 +131,13 @@ impl ModelProvider for AmazonBedrockModelProvider {
     }
 
     fn account_state(&self) -> ProviderAccountResult {
+        let credential_source = if self.managed_auth().is_some() {
+            AmazonBedrockCredentialSource::CodexManaged
+        } else {
+            AmazonBedrockCredentialSource::AwsManaged
+        };
         Ok(ProviderAccountState {
-            account: Some(ProviderAccount::AmazonBedrock),
+            account: Some(ProviderAccount::AmazonBedrock { credential_source }),
             requires_openai_auth: false,
         })
     }
@@ -209,6 +215,15 @@ mod tests {
             provider.auth().await,
             Some(CodexAuth::BedrockApiKey(managed_auth))
         );
+        assert_eq!(
+            provider.account_state(),
+            Ok(ProviderAccountState {
+                account: Some(ProviderAccount::AmazonBedrock {
+                    credential_source: AmazonBedrockCredentialSource::CodexManaged,
+                }),
+                requires_openai_auth: false,
+            })
+        );
         assert_eq!(
             provider
                 .runtime_base_url()
@@ -238,6 +253,15 @@ mod tests {
 
         assert!(provider.auth_manager().is_none());
         assert_eq!(provider.auth().await, None);
+        assert_eq!(
+            provider.account_state(),
+            Ok(ProviderAccountState {
+                account: Some(ProviderAccount::AmazonBedrock {
+                    credential_source: AmazonBedrockCredentialSource::AwsManaged,
+                }),
+                requires_openai_auth: false,
+            })
+        );
     }
 
     #[test]

codex-rs/model-provider/src/provider.rs

@@ -577,7 +577,10 @@ mod tests {
         assert_eq!(
             provider.account_state(),
             Ok(ProviderAccountState {
-                account: Some(ProviderAccount::AmazonBedrock),
+                account: Some(ProviderAccount::AmazonBedrock {
+                    credential_source:
+                        codex_protocol::account::AmazonBedrockCredentialSource::AwsManaged,
+                }),
                 requires_openai_auth: false,
             })
         );