feat: support default AWS credentials chain instead of static creds

[Joseph Zhang (jzhn)]

What

Make the bedrock provider authenticate via the AWS SDK default credential provider chain (shared profile, IRSA/web-identity, ECS/EC2 instance role, or ambient AWS_* env vars) instead of requiring a pasted static access key + secret. Static keys remain supported for backwards compatibility.

Why

Previously Bedrock only worked with long-lived BEDROCK_AWS_ACCESS_KEY_ID / BEDROCK_AWS_SECRET_ACCESS_KEY, and onboarding blocked until they were entered. That's a non-starter for IRSA/ECS/instance-role deployments and anyone using a shared AWS profile.

How

Bedrock is now a keyless provider, modeled on the existing gemini-enterprise (Google ADC) pattern:

• PROVIDER_CONFIGS.bedrock no longer declares apiKeyEnvKey/secretKeyEnvKey/regionEnvKey, so no provider-config machinery treats AWS creds as required.
• createModel passes credentials only when both BEDROCK_AWS_ACCESS_KEY_ID and BEDROCK_AWS_SECRET_ACCESS_KEY are set; otherwise it omits them and lets the SDK's default chain resolve. Region resolves from BEDROCK_AWS_REGION → AWS_REGION → AWS_DEFAULT_REGION (the SDK only checks AWS_DEFAULT_REGION on its own, so we bridge AWS_REGION which IRSA/ECS commonly inject).
• Onboarding no longer prompts for AWS credentials when Bedrock is selected.

Usage

Default credential chain (no static keys needed):

OPENWIKI_PROVIDER=bedrock
OPENWIKI_MODEL_ID=anthropic.claude-sonnet-5
# region from BEDROCK_AWS_REGION / AWS_REGION / AWS_DEFAULT_REGION

Static-key override (unchanged behavior):

OPENWIKI_PROVIDER=bedrock
BEDROCK_AWS_ACCESS_KEY_ID=...
BEDROCK_AWS_SECRET_ACCESS_KEY=...
BEDROCK_AWS_REGION=us-east-1
OPENWIKI_MODEL_ID=anthropic.claude-sonnet-5

Tests

• Updated unit test
• manual testing with AWS_PROFILE with credentials_process - credentials_process is invoked by openwiki to obtain Bedrock credentials

[Colin Francis (colifran)]

Very nice. Taking a look!