CORE-1801: Support Bedrock authentication in Fold Codex

[K-Mistele]

Summary

• add a separate codex_bedrock auth record without changing existing Codex OAuth data
• resolve ChatGPT or Amazon Bedrock from explicit options, the Fold auth store, or Codex config.toml
• generate and cache Bedrock bearer keys in memory, refresh lazily, and retry once after recognized auth failures
• route Fold Codex requests through the regional Bedrock Mantle Responses endpoint
• add coverage for storage compatibility, selection precedence, refresh concurrency, request retry, and URL/model mapping

Testing

• bun run typecheck
• bun run test
• bun run format:check
• changed-file type-aware lint
• git diff --check

Part of CORE-1801.