feat: add opt-in provider runtime abstraction (#17713)

## Summary

- Add `codex-model-provider` as the runtime home for model-provider
behavior that does not belong in `codex-core`, `codex-login`, or
`codex-api`.
- The new crate wraps configured `ModelProviderInfo` in a
`ModelProvider` trait object that can resolve the API provider config,
provider-scoped auth manager, and request auth provider for each call.
- This centralizes provider auth behavior in one place today, and gives
us an extension point for future provider-specific auth, model listing,
request setup, and related runtime behavior.

## Tests
Ran tests manually to make sure that provider auth under different
configs still work as expected.

---------

Co-authored-by: pakrym-oai <pakrym@openai.com>

codex-rs/cli/src/responses_cmd.rs

@@ -1,5 +1,6 @@
 use clap::Parser;
 use codex_core::config::Config;
+use codex_model_provider::create_model_provider;
 use codex_utils_cli::CliConfigOverrides;
 use serde_json::json;
 use tokio::io::AsyncReadExt;
@@ -29,16 +30,9 @@ pub(crate) async fn run_responses_command(
     let base_auth_manager = codex_login::AuthManager::shared_from_config(
         &config, /*enable_codex_api_key_env*/ true,
     );
-    let auth_manager =
-        codex_login::auth_manager_for_provider(Some(base_auth_manager), &config.model_provider);
-    let auth = match auth_manager {
-        Some(auth_manager) => auth_manager.auth().await,
-        None => None,
-    };
-    let api_provider = config
-        .model_provider
-        .to_api_provider(auth.as_ref().map(codex_login::CodexAuth::auth_mode))?;
-    let api_auth = codex_login::auth_provider_from_auth(auth, &config.model_provider)?;
+    let model_provider = create_model_provider(config.model_provider, Some(base_auth_manager));
+    let api_provider = model_provider.api_provider().await?;
+    let api_auth = model_provider.api_auth().await?;
     let client = codex_api::ResponsesClient::new(
         codex_api::ReqwestTransport::new(codex_login::default_client::build_reqwest_client()),
         api_provider,