feat(agent): add AWS Bedrock provider support

[Chukwuebuka-2003]

Summary

Add first-class AWS Bedrock provider support to Buzz agents, selectable per agent like Anthropic/OpenAI/Databricks. This is the foundation — the provider enum variant, SigV4 signing module, and LLM routing stubs are in place.

Refs #3614

Changes

Task 1: Provider::Bedrock variant (committed)

• Added Provider::Bedrock to the Provider enum in config.rs
• Added Bedrock match arm in Config::from_env() — reads AWS_REGION/AWS_DEFAULT_REGION + BEDROCK_MODEL, derives base URL as https://bedrock-runtime.{region}.amazonaws.com
• Added "bedrock" → Ok(Provider::Bedrock) to resolve_provider()

Task 2: AWS SigV4 signing module (committed)

• Created crates/buzz-agent/src/sigv4.rs with:
  • sign_request() — signs an HTTP request with AWS SigV4 using the aws-sigv4 crate
  • load_aws_credentials() — reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN from env
  • parse_bedrock_region() — extracts region from https://bedrock-runtime.{region}.amazonaws.com
  • 6 unit tests covering signing with/without session tokens, region parsing, and credential loading — all passing

LLM routing stubs

• Added Provider::Bedrock match arms in Llm::complete() and Llm::summarize() (return AgentError for now — real Converse API integration to follow)
• Added Bedrock to build_token_source() (no-op token source — SigV4 replaces bearer auth)
• Added required dependencies: aws-sigv4 (with http1 feature), aws-credential-types, aws-types, aws-smithy-runtime-api, http

Next steps (follow-up PRs)

• Task 3: Real Bedrock Converse API integration in llm.rs (body builders, response parser, post_bedrock())
• Task 4: Bedrock model catalog discovery via ListFoundationModels
• Task 5: Desktop backend (Tauri) provider registration
• Task 6: Desktop UI provider selection and credential fields

Testing

cargo test -p buzz-agent           # 22 passed (including 6 new SigV4 tests)
cargo check -p buzz-agent          # compiles cleanly

[ptahdunbar]

Heads up for coordination — I have a follow-on fix ready to go once this (and #3704) merges: sigv4::load_aws_credentials currently only reads AWS_ACCESS_KEY_ID/SECRET/SESSION_TOKEN directly from env, so AWS_PROFILE (~/.aws/credentials/config), SSO, and IAM roles (IMDS, ECS task roles, EKS IRSA) have no way to authenticate — this is called out but deferred in the module's own doc comment. I've switched it to aws-config's standard default credential provider chain (async, region-aware) so all of those work, and relaxed the desktop readiness gate that currently demands AWS_ACCESS_KEY_ID unconditionally (which incorrectly reports "not ready" for profile/role-based auth). Also have desktop UI for selecting the Bedrock provider in agent config.

Not opening a PR yet since it's built directly on top of your sigv4.rs/catalog_bedrock.rs/Provider::Bedrock additions, which aren't on main yet — didn't want to add review noise on an unmerged foundation. Happy to rebase and open once this lands, or coordinate before then if useful.