chore: improve expired Bedrock credential errors

[celia-oai]

Why

Amazon Bedrock returns a 401 Unauthorized response containing Signature expired: when an AWS credential, including a short-lived AWS_BEARER_TOKEN_BEDROCK, has expired. Codex currently surfaces that response as a generic unexpected status error, which does not explain how to recover.

Environment-provided bearer tokens cannot be refreshed automatically, so the error should direct users to refresh their AWS credentials or replace or remove the environment token and restart Codex. This classification belongs to the Amazon Bedrock provider so similar responses from other providers retain their existing behavior.

What changed

• Add a synchronous ModelProvider::map_api_error hook that defaults to the existing provider-neutral API error mapping, and route model request, stream, WebSocket, and terminal unauthorized errors through the active provider.
• Override the hook for Amazon Bedrock. After preserving the structured status, body, URL, and request metadata, recognize 401 responses containing Signature expired: and attach actionable credential guidance.
• Keep codex-protocol provider-neutral by representing the guidance as an optional user_message. Error rendering prefers this message while continuing to append the URL, request ID, Cloudflare ray, and authorization diagnostics.
• Add model-provider coverage for expired signatures and negative cases, core coverage for provider dispatch after unauthorized recovery, and a TUI snapshot for the rendered error.

Testing

Tested with a real request with expired bedrock key: