Support Amazon Bedrock as an embedded agent provider #1307

Problem

Teams that run Claude through Amazon Bedrock - to keep model traffic inside their own AWS account can get there by standing up a translating proxy in front of Bedrock like LiteLLM.
That workaround has real costs: another service to deploy, monitor and patch; another credential to issue and rotate; an extra network hop inside the request path of every search.

Proposal

Add bedrock as a first-class provider.
It has to authenticate from an IAM role alone, with no API credentials - the usual deployment is a pod or container with a role already attached (EC2/ECS roles, EKS pod identity, IRSA) or a developer on an SSO profile. Order: AWS_BEARER_TOKEN_BEDROCK → AWS credential chain → static keys.

Config mirrors the existing providers: EMBEDDED_AGENT_PROVIDER=bedrock / --agent-provider=bedrock, AWS_REGION, BEDROCK_MODEL / --bedrock-model, --bedrock-base-url for VPC endpoints.