feat(agent): implement Bedrock Converse API, model catalog, and desktop backend

[Chukwuebuka-2003]

Summary

Implement the Bedrock Converse API integration, model catalog discovery, and desktop backend registration for the AWS Bedrock provider.

Refs #3614

Changes

Task 3: Bedrock Converse API in llm.rs

• post_bedrock() — SigV4-signed POST to /model/{id}/converse, loads AWS creds from env
• bedrock_converse_body() — full Converse API body builder: messages, system prompt, toolConfig with toolSpec (text + image tool results)
• bedrock_converse_summary_body() — slim body for summarize path
• parse_bedrock_converse() — extracts text, tool calls (toolUse blocks), stopReason mapping (end_turn/tool_use/max_tokens/content_filtered), usage tokens
• Wired into both complete() and summarize() match arms
• build_token_source() fixed — Bedrock now returns a no-op token source (SigV4 ≠ bearer auth)

Task 4: Bedrock model catalog

• catalog_bedrock.rs with discover_bedrock_models() — GETs ListFoundationModels with SigV4 signing
• parse_bedrock_model_list() — filters to ON_DEMAND + TEXT models, builds display names as "ModelName (Provider)"
• 5 unit tests covering basic parsing, filtering, empty responses

Task 5: Desktop backend (Tauri)

• agent_models.rs: Added is_bedrock_provider() and discover_bedrock_models() — reads AWS_REGION/AWS_DEFAULT_REGION, builds Config, calls discover_bedrock_models(). Wired into both saved-agent (get_agent_models) and new-agent (discover_agent_models) discovery chains
• readiness.rs: Added Bedrock credential requirements (AWS_ACCESS_KEY_ID, AWS_REGION) and model key (BEDROCK_MODEL)

Testing

cargo check --workspace   # compiles cleanly
cargo test -p buzz-agent   # 389 passed (incl. 11 new Bedrock tests)

[ptahdunbar]

Same note as I left on #3698 — I have a follow-on credential-chain fix + desktop config UI built on top of this branch's sigv4.rs/catalog_bedrock.rs/Provider::Bedrock work, ready to rebase and PR once this merges. Holding off opening it now since it isn't mergeable standalone against main while this is still open (my diff would otherwise carry your unreviewed commits along with it).

Summary of what's queued: load_aws_credentials moves from raw env-var reads to aws-config's default provider chain (env vars, AWS_PROFILE, SSO, IMDS/ECS/EKS IRSA roles), plus a matching fix to the desktop readiness gate that today requires AWS_ACCESS_KEY_ID even when the agent is configured via profile or role. Let me know if it'd help to coordinate before this merges rather than after.