chore: improve expired Bedrock credential errors (#28992)

## Why

Amazon Bedrock returns a `401 Unauthorized` response containing
`Signature expired:` when an AWS credential, including a short-lived
`AWS_BEARER_TOKEN_BEDROCK`, has expired. Codex currently surfaces that
response as a generic `unexpected status` error, which does not explain
how to recover.

Environment-provided bearer tokens cannot be refreshed automatically, so
the error should direct users to refresh their AWS credentials or
replace or remove the environment token and restart Codex. This
classification belongs to the Amazon Bedrock provider so similar
responses from other providers retain their existing behavior.

## What changed

- Add a synchronous `ModelProvider::map_api_error` hook that defaults to
the existing provider-neutral API error mapping, and route model
request, stream, WebSocket, and terminal unauthorized errors through the
active provider.
- Override the hook for Amazon Bedrock. After preserving the structured
status, body, URL, and request metadata, recognize `401` responses
containing `Signature expired:` and attach actionable credential
guidance.
- Keep `codex-protocol` provider-neutral by representing the guidance as
an optional `user_message`. Error rendering prefers this message while
continuing to append the URL, request ID, Cloudflare ray, and
authorization diagnostics.
- Add model-provider coverage for expired signatures and negative cases,
core coverage for provider dispatch after unauthorized recovery, and a
TUI snapshot for the rendered error.

## Testing
Tested with a real request with expired bedrock key:
<img width="962" height="126" alt="Screenshot 2026-06-22 at 3 56 51 PM"
src="https://github.com/user-attachments/assets/7e21cc7c-798e-4662-8467-7f304a2f2b59"
/>

codex-rs/codex-api/src/api_bridge.rs

@@ -23,15 +23,19 @@ pub fn map_api_error(err: ApiError) -> CodexErr {
         ApiError::Retryable { message, delay } => CodexErr::Stream(message, delay),
         ApiError::Stream(msg) => CodexErr::Stream(msg, None),
         ApiError::ServerOverloaded => CodexErr::ServerOverloaded,
-        ApiError::Api { status, message } => CodexErr::UnexpectedStatus(UnexpectedResponseError {
-            status,
-            body: message,
-            url: None,
-            cf_ray: None,
-            request_id: None,
-            identity_authorization_error: None,
-            identity_error_code: None,
-        }),
+        ApiError::Api { status, message } => {
+            let user_message = api_error_user_message(status, &message);
+            CodexErr::UnexpectedStatus(UnexpectedResponseError {
+                status,
+                body: message,
+                user_message,
+                url: None,
+                cf_ray: None,
+                request_id: None,
+                identity_authorization_error: None,
+                identity_error_code: None,
+            })
+        }
         ApiError::InvalidRequest { message } => CodexErr::InvalidRequest(message),
         ApiError::CyberPolicy { message } => CodexErr::CyberPolicy { message },
         ApiError::Transport(transport) => match transport {
@@ -111,6 +115,7 @@ pub fn map_api_error(err: ApiError) -> CodexErr {
                 } else {
                     CodexErr::UnexpectedStatus(UnexpectedResponseError {
                         status,
+                        user_message: api_error_user_message(status, &body_text),
                         body: body_text,
                         url,
                         cf_ray: extract_header(headers.as_ref(), CF_RAY_HEADER),
@@ -145,6 +150,8 @@ const X_ERROR_JSON_HEADER: &str = "x-error-json";
 const CYBER_POLICY_ERROR_CODE: &str = "cyber_policy";
 const CYBER_POLICY_FALLBACK_MESSAGE: &str =
     "This request has been flagged for possible cybersecurity risk.";
+const CLOUDFLARE_BLOCKED_MESSAGE: &str =
+    "Access blocked by Cloudflare. This usually happens when connecting from a restricted region";
 
 #[cfg(test)]
 #[path = "api_bridge_tests.rs"]
@@ -154,6 +161,17 @@ fn extract_request_tracking_id(headers: Option<&HeaderMap>) -> Option<String> {
     extract_request_id(headers).or_else(|| extract_header(headers, CF_RAY_HEADER))
 }
 
+fn api_error_user_message(status: http::StatusCode, body: &str) -> Option<String> {
+    if status == http::StatusCode::FORBIDDEN
+        && body.contains("Cloudflare")
+        && body.contains("blocked")
+    {
+        Some(format!("{CLOUDFLARE_BLOCKED_MESSAGE} (status {status})"))
+    } else {
+        None
+    }
+}
+
 fn extract_request_id(headers: Option<&HeaderMap>) -> Option<String> {
     extract_header(headers, REQUEST_ID_HEADER)
         .or_else(|| extract_header(headers, OAI_REQUEST_ID_HEADER))

codex-rs/codex-api/src/api_bridge_tests.rs

@@ -26,6 +26,34 @@ fn map_api_error_maps_server_overloaded_from_503_body() {
     assert!(matches!(err, CodexErr::ServerOverloaded));
 }
 
+#[test]
+fn map_api_error_maps_cloudflare_blocked_response_to_user_message() {
+    let mut headers = HeaderMap::new();
+    headers.insert(CF_RAY_HEADER, http::HeaderValue::from_static("ray-id"));
+    let err = map_api_error(ApiError::Transport(TransportError::Http {
+        status: http::StatusCode::FORBIDDEN,
+        url: Some("http://example.com/blocked".to_string()),
+        headers: Some(headers),
+        body: Some(
+            "<html><body>Cloudflare error: Sorry, you have been blocked</body></html>".to_string(),
+        ),
+    }));
+
+    let CodexErr::UnexpectedStatus(err) = err else {
+        panic!("expected CodexErr::UnexpectedStatus, got {err:?}");
+    };
+    assert_eq!(
+        err.user_message.as_deref(),
+        Some(
+            "Access blocked by Cloudflare. This usually happens when connecting from a restricted region (status 403 Forbidden)"
+        )
+    );
+    assert_eq!(
+        err.to_string(),
+        "Access blocked by Cloudflare. This usually happens when connecting from a restricted region (status 403 Forbidden), url: http://example.com/blocked, cf-ray: ray-id"
+    );
+}
+
 #[test]
 fn map_api_error_maps_cyber_policy_from_400_body() {
     let body = serde_json::json!({