[codex] Add codex-api client factory

[pakrym-oai]

Why

codex-core creates several codex-api REST clients from the same provider/auth setup, but each call site constructed the concrete client directly. This makes it harder to add shared client creation behavior without touching every client type or turning ModelClient into the owner of unrelated services.

What changed

• Added an ApiClientFactory plus an ApiClient trait implemented directly on the codex-api client types used by core.
• Stored the factory as a peer service on SessionServices, built from the same shared model provider as ModelClient.
• Routed compact, memories, realtime-call, and Responses streaming paths through the factory so call sites can create clients generically.
• Kept ModelClient from owning or vending the factory; session construction creates both services from the shared provider.

Validation

• cargo check -p codex-core
• just fix -p codex-core
• just bazel-lock-update
• just bazel-lock-check