Bind reusable backend clients to runtime authentication (#59255)

## Why

Reusable clients need fresh authentication for each request while preserving the credential source and transport policy selected when the client was created.

## What changed

- Add runtime-aware backend client construction and per-request authentication. Allow token refresh within the original credential source, reject credential replacement, and validate destination and account/organization selectors.
- Let runtime authentication finish persisting rotated tokens when the requesting task is cancelled.
- Apply asynchronous authentication to file creation and finalization requests, generating fresh assertions while keeping credentials off blob uploads.
- Preserve direct sandbox routing without enabling legacy custom-CA fallback for protected clients that reject redirects.
- Exclude login account metadata from model cache identities when provider bearer credentials override the login, and record authentication selection outcomes and duration.

## Testing

Add regression coverage for credential refresh and replacement, organization selection, destination restrictions, transport policy preservation, cancellation during token rotation, credential stripping on redirects, and file upload authentication in both runtime authentication modes.

GitOrigin-RevId: d045595e869dfcdfd9f705a6228cf0eb4c2d2c12

codex-rs/codex-api/src/files.rs

@@ -8,6 +8,7 @@ use codex_http_client::RequestBuilder;
 use codex_http_client::RouteAwareClientPool;
 use codex_http_client::RouteAwareRequestError;
 use futures::Stream;
+use http::HeaderMap;
 use http::Method;
 use http::StatusCode;
 use http::header::CONTENT_LENGTH;
@@ -154,7 +155,7 @@ where
         "file_size": file_size_bytes,
         "use_case": OPENAI_FILE_USE_CASE,
     });
-    let request = authorized_request(client_pool, auth, Method::POST, &create_url)?;
+    let request = authorized_request(client_pool, auth, Method::POST, &create_url).await?;
     let create_request = match hosted_upload {
         Some(context) => serde_json::json!({
             "file_name": file_name.as_str(),
@@ -365,7 +366,8 @@ where
     };
     let finalize_started_at = Instant::now();
     loop {
-        let finalize_response = authorized_request(client_pool, auth, Method::POST, &finalize_url)?
+        let finalize_response = authorized_request(client_pool, auth, Method::POST, &finalize_url)
+            .await?
             .json(&finalize_request)
             .send()
             .await
@@ -432,14 +434,13 @@ where
     }
 }
 
-fn authorized_request(
+async fn authorized_request(
     client_pool: &RouteAwareClientPool,
     auth: &dyn AuthProvider,
     method: Method,
     url: &str,
 ) -> Result<RequestBuilder, OpenAiFileError> {
-    let mut headers = http::HeaderMap::new();
-    auth.add_auth_headers(&mut headers)?;
+    let headers = auth.apply_auth_headers(HeaderMap::new()).await?;
 
     Ok(client_pool
         .request(method, url)