extract models manager and related ownership from core (#16508)

## Summary
- split `models-manager` out of `core` and add `ModelsManagerConfig`
plus `Config::to_models_manager_config()` so model metadata paths stop
depending on `core::Config`
- move login-owned/auth-owned code out of `core` into `codex-login`,
move model provider config into `codex-model-provider-info`, move API
bridge mapping into `codex-api`, move protocol-owned types/impls into
`codex-protocol`, and move response debug helpers into a dedicated
`response-debug-context` crate
- move feedback tag emission into `codex-feedback`, relocate tests to
the crates that now own the code, and keep broad temporary re-exports so
this PR avoids a giant import-only rewrite

## Major moves and decisions
- created `codex-models-manager` as the owner for model
cache/catalog/config/model info logic, including the new
`ModelsManagerConfig` struct
- created `codex-model-provider-info` as the owner for provider config
parsing/defaults and kept temporary `codex-login`/`codex-core`
re-exports for old import paths
- moved `api_bridge` error mapping + `CoreAuthProvider` into
`codex-api`, while `codex-login::api_bridge` temporarily re-exports
those symbols and keeps the `auth_provider_from_auth` wrapper
- moved `auth_env_telemetry` and `provider_auth` ownership to
`codex-login`
- moved `CodexErr` ownership to `codex-protocol::error`, plus
`StreamOutput`, `bytes_to_string_smart`, and network policy helpers to
protocol-owned modules
- created `codex-response-debug-context` for
`extract_response_debug_context`, `telemetry_transport_error_message`,
and related response-debug plumbing instead of leaving that behavior in
`core`
- moved `FeedbackRequestTags`, `emit_feedback_request_tags`, and
`emit_feedback_request_tags_with_auth_env` to `codex-feedback`
- deferred removal of temporary re-exports and the mechanical import
rewrites to a stacked follow-up PR so this PR stays reviewable

## Test moves
- moved auth refresh coverage from `core/tests/suite/auth_refresh.rs` to
`login/tests/suite/auth_refresh.rs`
- moved text encoding coverage from
`core/tests/suite/text_encoding_fix.rs` to
`protocol/src/exec_output_tests.rs`
- moved model info override coverage from
`core/tests/suite/model_info_overrides.rs` to
`models-manager/src/model_info_overrides_tests.rs`

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/login/src/token_data.rs

@@ -1,6 +1,7 @@
 use base64::Engine;
 use chrono::DateTime;
 use chrono::Utc;
+use codex_protocol::auth::PlanType;
 use serde::Deserialize;
 use serde::Serialize;
 use serde::de::DeserializeOwned;
@@ -61,95 +62,6 @@ impl IdTokenInfo {
     }
 }
 
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum PlanType {
-    Known(KnownPlan),
-    Unknown(String),
-}
-
-impl PlanType {
-    pub fn from_raw_value(raw: &str) -> Self {
-        match raw.to_ascii_lowercase().as_str() {
-            "free" => Self::Known(KnownPlan::Free),
-            "go" => Self::Known(KnownPlan::Go),
-            "plus" => Self::Known(KnownPlan::Plus),
-            "pro" => Self::Known(KnownPlan::Pro),
-            "team" => Self::Known(KnownPlan::Team),
-            "self_serve_business_usage_based" => {
-                Self::Known(KnownPlan::SelfServeBusinessUsageBased)
-            }
-            "business" => Self::Known(KnownPlan::Business),
-            "enterprise_cbp_usage_based" => Self::Known(KnownPlan::EnterpriseCbpUsageBased),
-            "enterprise" | "hc" => Self::Known(KnownPlan::Enterprise),
-            "education" | "edu" => Self::Known(KnownPlan::Edu),
-            _ => Self::Unknown(raw.to_string()),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum KnownPlan {
-    Free,
-    Go,
-    Plus,
-    Pro,
-    Team,
-    #[serde(rename = "self_serve_business_usage_based")]
-    SelfServeBusinessUsageBased,
-    Business,
-    #[serde(rename = "enterprise_cbp_usage_based")]
-    EnterpriseCbpUsageBased,
-    #[serde(alias = "hc")]
-    Enterprise,
-    Edu,
-}
-
-impl KnownPlan {
-    pub fn display_name(self) -> &'static str {
-        match self {
-            Self::Free => "Free",
-            Self::Go => "Go",
-            Self::Plus => "Plus",
-            Self::Pro => "Pro",
-            Self::Team => "Team",
-            Self::SelfServeBusinessUsageBased => "Self Serve Business Usage Based",
-            Self::Business => "Business",
-            Self::EnterpriseCbpUsageBased => "Enterprise CBP Usage Based",
-            Self::Enterprise => "Enterprise",
-            Self::Edu => "Edu",
-        }
-    }
-
-    pub fn raw_value(self) -> &'static str {
-        match self {
-            Self::Free => "free",
-            Self::Go => "go",
-            Self::Plus => "plus",
-            Self::Pro => "pro",
-            Self::Team => "team",
-            Self::SelfServeBusinessUsageBased => "self_serve_business_usage_based",
-            Self::Business => "business",
-            Self::EnterpriseCbpUsageBased => "enterprise_cbp_usage_based",
-            Self::Enterprise => "enterprise",
-            Self::Edu => "edu",
-        }
-    }
-
-    pub fn is_workspace_account(self) -> bool {
-        matches!(
-            self,
-            Self::Team
-                | Self::SelfServeBusinessUsageBased
-                | Self::Business
-                | Self::EnterpriseCbpUsageBased
-                | Self::Enterprise
-                | Self::Edu
-        )
-    }
-}
-
 #[derive(Deserialize)]
 struct IdClaims {
     #[serde(default)]