inference: AuthHeader::SigV4 + AWS SigV4 signer for direct AWS Bedrock #1801

Summary

Follow-up to #1704 (which registered aws-bedrock as
a bridge-fronted profile with auth: AuthHeader::None). To support
direct AWS Bedrock as an upstream — no translating bridge in the
middle — the router needs to sign outbound requests with AWS SigV4.

Background

aws-bedrock providers carry four credentials (AWS_ACCESS_KEY_ID,
AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_REGION) and an
operator-supplied BEDROCK_BASE_URL. Today the router consumes none
of these on the outbound path: AuthHeader::None skips header
injection entirely, and the configured upstream (a bridge in this
shape) handles auth itself.

For operators wanting to point BEDROCK_BASE_URL at
https://bedrock-runtime.<region>.amazonaws.com directly, the
router must compute SigV4 over each outbound request:
canonical-request → string-to-sign → signing key (date / region /
service) → Authorization: AWS4-HMAC-SHA256 …. Plus
x-amz-content-sha256 and (when present) x-amz-security-token for
session credentials.

Proposal

1. Extend core::inference::AuthHeader with a new variant:

   /// AWS SigV4 request signing. The router computes the
   /// Authorization header per request from credentials carried on
   /// the route (access key, secret, optional session token) plus
   /// the route's region and AWS service.
   SigV4 { service: &'static str },

   service is "bedrock" for aws-bedrock; the variant generalizes
   to any future SigV4-authed AWS provider.
2. Carry the four AWS credentials through the route resolution path
   (today RouterResolvedRoute carries a single api_key; either
   add a secret_credentials: HashMap<String, String> or model
   AWS-specific fields on the route variant).
3. Add a aws-sigv4 (crate) dependency in openshell-router. Sign
   in backend.rs before the existing header-injection switch.
4. Switch AWS_BEDROCK_PROFILE to:

   credential_key_names: &[
       "AWS_ACCESS_KEY_ID",
       "AWS_SECRET_ACCESS_KEY",
       "AWS_SESSION_TOKEN",
       "AWS_REGION",
   ],
   auth: AuthHeader::SigV4 { service: "bedrock" },

   Bridge-fronted setups continue to work — they just override
   BEDROCK_BASE_URL and won't actually need the SigV4 auth header
   to be valid (most bridges ignore it). Direct-AWS setups get
   correctly signed requests.
5. Tests:
   • Round-trip SigV4 against a known-fixture canonical request +
     date pair (the AWS docs ship test vectors).
   • Verify the x-amz-security-token header is present iff a
     session token is present.

Acceptance

• openshell provider create --type aws-bedrock --from-existing
  picks up local AWS credentials.
• openshell inference set --provider <name> against a real
  bedrock-runtime.<region>.amazonaws.com URL produces working
  outbound calls.
• Bridge-fronted setups (where the bridge ignores the inbound
  auth header) continue to work unchanged.

Why separate from #1704

#1704 already cleared four-rounds-of-review on the bridge-fronted
shape. Adding SigV4 signing — new dependency, secret-handling code
on the router hot path, test fixtures — substantially expands review
surface and was explicitly deferred in the original commit message
(8b30211a).

Happy to take a stab.