Redact Bedrock API keys from debug output (#40706)

## Why

Derived debug formatting exposed the managed Amazon Bedrock API key.

## What changed

Implement custom `Debug` formatting for `BedrockApiKeyAuth` that replaces the
API key with `<redacted>` while retaining the region.

## Testing

Add regression coverage for direct and `CodexAuth`-wrapped debug output.

GitOrigin-RevId: 68920fa00a9189c959b0025f22797b32f53d1995

codex-rs/login/src/auth/bedrock_api_key.rs

@@ -1,3 +1,4 @@
+use std::fmt;
 use std::path::Path;
 
 use codex_config::types::AuthCredentialsStoreMode;
@@ -10,12 +11,21 @@ use super::storage::AuthKeyringBackendKind;
 use codex_protocol::auth::AuthMode;
 
 /// Managed Amazon Bedrock API key persisted in `auth.json`.
-#[derive(Deserialize, Serialize, Clone, Debug, PartialEq, Eq)]
+#[derive(Deserialize, Serialize, Clone, PartialEq, Eq)]
 pub struct BedrockApiKeyAuth {
     pub api_key: String,
     pub region: String,
 }
 
+impl fmt::Debug for BedrockApiKeyAuth {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("BedrockApiKeyAuth")
+            .field("api_key", &"<redacted>")
+            .field("region", &self.region)
+            .finish()
+    }
+}
+
 /// Writes an `auth.json` that contains only the Amazon Bedrock API key auth.
 pub fn login_with_bedrock_api_key(
     codex_home: &Path,

codex-rs/login/src/auth/bedrock_api_key_tests.rs

@@ -44,6 +44,20 @@ fn bedrock_auth() -> BedrockApiKeyAuth {
     }
 }
 
+#[test]
+fn bedrock_api_key_debug_redacts_secret() {
+    let auth = bedrock_auth();
+
+    assert_eq!(
+        format!("{auth:?}"),
+        r#"BedrockApiKeyAuth { api_key: "<redacted>", region: "us-east-1" }"#
+    );
+    assert_eq!(
+        format!("{:?}", CodexAuth::BedrockApiKey(auth)),
+        r#"BedrockApiKey(BedrockApiKeyAuth { api_key: "<redacted>", region: "us-east-1" })"#
+    );
+}
+
 #[tokio::test]
 #[serial(codex_auth_env)]
 async fn login_with_bedrock_api_key_replaces_openai_auth() -> anyhow::Result<()> {