feat(agent): add AWS Bedrock provider support

[Chukwuebuka-2003]

Summary

Add first-class AWS Bedrock provider support to Buzz agents, selectable per agent like Anthropic/OpenAI/Databricks. This is the foundation — the provider enum variant, SigV4 signing module, and LLM routing stubs are in place.

Refs #3614

Changes

Task 1: Provider::Bedrock variant (committed)

• Added Provider::Bedrock to the Provider enum in config.rs
• Added Bedrock match arm in Config::from_env() — reads AWS_REGION/AWS_DEFAULT_REGION + BEDROCK_MODEL, derives base URL as https://bedrock-runtime.{region}.amazonaws.com
• Added "bedrock" → Ok(Provider::Bedrock) to resolve_provider()

Task 2: AWS SigV4 signing module (committed)

• Created crates/buzz-agent/src/sigv4.rs with:
  • sign_request() — signs an HTTP request with AWS SigV4 using the aws-sigv4 crate
  • load_aws_credentials() — reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN from env
  • parse_bedrock_region() — extracts region from https://bedrock-runtime.{region}.amazonaws.com
  • 6 unit tests covering signing with/without session tokens, region parsing, and credential loading — all passing

LLM routing stubs

• Added Provider::Bedrock match arms in Llm::complete() and Llm::summarize() (return AgentError for now — real Converse API integration to follow)
• Added Bedrock to build_token_source() (no-op token source — SigV4 replaces bearer auth)
• Added required dependencies: aws-sigv4 (with http1 feature), aws-credential-types, aws-types, aws-smithy-runtime-api, http

Next steps (follow-up PRs)

• Task 3: Real Bedrock Converse API integration in llm.rs (body builders, response parser, post_bedrock())
• Task 4: Bedrock model catalog discovery via ListFoundationModels
• Task 5: Desktop backend (Tauri) provider registration
• Task 6: Desktop UI provider selection and credential fields

Testing

cargo test -p buzz-agent           # 22 passed (including 6 new SigV4 tests)
cargo check -p buzz-agent          # compiles cleanly