feat(provider): add Amazon Bedrock IAM Identity Center SSO

[keyuchen21]

Summary

• register amazon-bedrock as a first-class provider with typed IAM Identity Center configuration and a dedicated aws_sso credential kind
• add a Host-owned bedrock.sso.* device-authorization lifecycle with account/role selection, bounded model discovery, manual model validation, and atomic onboarding recovery
• resolve and CAS-refresh SSO sessions in Runtime Host, while keeping temporary AWS role credentials memory-only and singleflight refreshed
• add Bedrock Converse/ConverseStream execution through @ai-sdk/amazon-bedrock, including auxiliary model calls, connection tests, inference-profile capability inheritance, and source-model pricing
• add the Desktop account setup flow and make the resulting connection available to Desktop, CLI, TUI, bots, and other Runtime Host clients
• route AWS SDK control-plane traffic through Maka's scoped fetch/proxy boundary and add permission/configuration error classification

Security properties

• OIDC client secrets, access/refresh tokens, device codes, and temporary role credentials never cross the Runtime Host protocol into renderer state
• temporary AWS role credentials are never persisted
• uncommitted login attempts are cancelled and cleared after a bounded TTL
• credential refresh uses canonical generation binding and CAS reconciliation, so logout/reauth cannot revive an old credential generation
• Bedrock connections reject custom request headers and body overlays to avoid post-signature mutation
• Desktop configuration exports omit IAM Identity Center sessions and require reauthorization after import

Validation

• npm run build
• npm run lint
• Core, Storage, Runtime, Runtime Host, and Desktop test suites
• Bedrock contract, protocol-secret-boundary, SSO session, provider conformance, pricing, and error-classification tests
• Desktop and CLI third-party notice checks
• live IAM Identity Center device authorization against a test tenant
• live Bedrock foundation-model and inference-profile discovery through the new Smithy-to-scoped-fetch handler
• live ConverseStream request with tool call, tool result replay, and final text

npm test completed every JavaScript/workspace suite, but the local @maka/eval Python continuation stopped because the machine has Python 3.9 and the existing test uses Python 3.10 union syntax (int | None). Its 75 Node tests passed before that environment-only failure.