feat: add Amazon Bedrock as alternative AI provider (AI_PROVIDER flag)

[tobigs]

Summary

Adds AI_PROVIDER environment variable (anthropic | bedrock, default anthropic) enabling Amazon Bedrock as an alternative AI backend — no API key required, uses IAM role credentials.

Changes

Shared

• New packages/shared/src/provider-config.ts — resolveProviderConfig() validates and defaults provider/model, resolveBedrockModel() derives the correct Bedrock CRIS model ID from AWS_REGION (eu/us/apac geographic prefixes)

Lambda path (packages/lambda-agent/)

• config-init.ts: conditional SSM skip, disable bedrockDiscovery (model selection is explicit), parameterised provider/api/model
• agent-runner.ts: wire provider config into the agent
• handler.ts: pass AI_PROVIDER and AI_MODEL from env

Fargate path (packages/container/)

• patch-config.ts: inject Bedrock LLM config, disable discovery, add AWS_PROFILE workaround

CDK (packages/cdk/)

• secrets-stack.ts: skip AnthropicApiKey SSM param when AI_PROVIDER=bedrock
• compute-stack.ts, lambda-agent-stack.ts: provision bedrock:InvokeModel IAM permissions (always, to avoid drift on switch)
• .env.example: document AI_PROVIDER and AI_MODEL

Docs & tests — 27 new unit tests for resolveProviderConfig and resolveBedrockModel; docs/deployment.md §10 AI Provider Configuration guide; CLAUDE.md updated.

Test plan

• Unit tests: all pass (including 27 new provider-config tests)
• E2E CDK synth pass

# Bedrock — AnthropicApiKey param should be absent
AI_PROVIDER=bedrock npx cdk synth 2>&1 | grep -i "anthropic"
# Expected: no AnthropicApiKey output

# Anthropic (default) — key should be present
npx cdk synth 2>&1 | grep -i "anthropic"

npx vitest run packages/container/__tests__/patch-config.test.ts
npx vitest run packages/lambda-agent/__tests__/config-init.test.ts
npx vitest run packages/shared/__tests__/provider-config.test.ts

🤖 Generated with Claude Code