providers: substitute {region} placeholder in YAML profile endpoints #1802

Summary

Follow-up to #1704. The aws-bedrock.yaml profile
hardcodes bedrock-runtime.us-east-1.amazonaws.com as the default
endpoint; operators in other regions must override the entire base
URL via BEDROCK_BASE_URL to flip a single segment. This generalizes
to any region-aware provider.

Proposal

Allow YAML profile endpoints[].host to contain a {region}
placeholder, substituted at provider-creation time from the
provider's resolved AWS_REGION credential (or, more generically, a
profile-declared region credential name).

Concretely, in aws-bedrock.yaml:

endpoints:
  - host: bedrock-runtime.{region}.amazonaws.com
    port: 443
    ...

…and in the YAML loader (openshell-providers/src/profiles.rs or
its successor): when host contains {region}, look up the
provider's AWS_REGION credential value and substitute. If absent,
fall back to a profile-declared default (e.g.
{region:us-east-1}-style syntax) or fail with a clear
invalid_argument Status.

Why separate from #1704

This affects the YAML loader and provider-create code path, not the
inference router. Independent review surface.

Acceptance

• openshell provider create --type aws-bedrock --credential AWS_REGION=eu-west-1 …
  resolves to bedrock-runtime.eu-west-1.amazonaws.com.
• BEDROCK_BASE_URL override still wins (preserves today's escape
  hatch).
• A test in openshell-providers covers the substitution + the
  missing-region failure.

Happy to implement.