Propagate resolved proxy policy through auth routing (#34649)

## Why

Auth routing represented the default proxy policy as an absent configuration,
leaving consumers to reconstruct the fallback HTTP client independently. Carry
the application's resolved policy explicitly so auth and related requests use
the same client configuration.

## What changed

- Build `AuthRouteConfig` from the resolved `HttpClientFactory` for both
  `ReqwestDefault` and `RespectSystemProxy` policies.
- Pass that route configuration through login, auth, cloud task, and cloud
  configuration flows, and reuse its factory when loading cloud configuration.
- Log cloud-task configuration load failures before falling back to the
  transport-default proxy policy.

## Testing

Extended configuration tests to verify that effective and bootstrap auth routes
select the expected proxy policy when system-proxy support is enabled or
disabled by feature requirements.

GitOrigin-RevId: d03802e2660f5cf6d940e8e718ec5c82ede7eab1

codex-rs/cli/src/login.rs

@@ -180,7 +180,7 @@ pub async fn run_login_with_chatgpt(cli_config_overrides: CliConfigOverrides) ->
         forced_chatgpt_workspace_id,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        config.auth_route_config(),
+        Some(config.auth_route_config()),
     )
     .await
     {
@@ -246,7 +246,7 @@ pub async fn run_login_with_access_token(
         config.forced_chatgpt_workspace_id.as_deref(),
         Some(&config.chatgpt_base_url),
         config.auth_keyring_backend_kind(),
-        auth_route_config.as_ref(),
+        Some(&auth_route_config),
     )
     .await
     {
@@ -320,7 +320,7 @@ pub async fn run_login_with_device_code(
         &config.codex_home,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        auth_route_config.as_ref(),
+        Some(&auth_route_config),
     )
     .await;
     let forced_chatgpt_workspace_id = config.forced_chatgpt_workspace_id.clone();
@@ -330,7 +330,7 @@ pub async fn run_login_with_device_code(
         forced_chatgpt_workspace_id,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        auth_route_config,
+        Some(auth_route_config),
     );
     if let Some(iss) = issuer_base_url {
         opts.issuer = iss;
@@ -368,7 +368,7 @@ pub async fn run_login_with_device_code_fallback_to_browser(
         &config.codex_home,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        auth_route_config.as_ref(),
+        Some(&auth_route_config),
     )
     .await;
 
@@ -379,7 +379,7 @@ pub async fn run_login_with_device_code_fallback_to_browser(
         forced_chatgpt_workspace_id,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        auth_route_config,
+        Some(auth_route_config),
     );
     if let Some(iss) = issuer_base_url {
         opts.issuer = iss;
@@ -430,7 +430,7 @@ pub async fn run_login_status(cli_config_overrides: CliConfigOverrides) -> ! {
         config.cli_auth_credentials_store_mode,
         Some(&config.chatgpt_base_url),
         config.auth_keyring_backend_kind(),
-        auth_route_config.as_ref(),
+        Some(&auth_route_config),
     )
     .await
     {
@@ -484,7 +484,7 @@ pub async fn run_logout(cli_config_overrides: CliConfigOverrides) -> ! {
         &config.codex_home,
         config.cli_auth_credentials_store_mode,
         config.auth_keyring_backend_kind(),
-        auth_route_config.as_ref(),
+        Some(&auth_route_config),
     )
     .await
     {

codex-rs/cli/src/main.rs

@@ -1756,7 +1756,7 @@ async fn load_exec_server_remote_auth_provider(
         let auth = CodexAuth::from_agent_identity_jwt(
             &agent_identity_jwt,
             Some(&config.chatgpt_base_url),
-            auth_route_config.as_ref(),
+            Some(&auth_route_config),
         )
         .await?;
         return Ok(codex_model_provider::auth_provider_from_auth(&auth));

codex-rs/cli/src/plugin_cmd.rs

@@ -610,7 +610,7 @@ pub(crate) async fn load_cli_auth_mode(config: &Config) -> Option<AuthMode> {
         config.cli_auth_credentials_store_mode,
         Some(&config.chatgpt_base_url),
         config.auth_keyring_backend_kind(),
-        auth_route_config.as_ref(),
+        Some(&auth_route_config),
     )
     .await
     .ok()