fix(core): resolve Bedrock credentials from the AWS default chain

[rekram1-node]

Summary

Restores AWS default credential chain support (profile, ~/.aws/credentials, SSO, process creds, instance/container roles) for native Bedrock, which was lost when Bedrock routing moved off the AI SDK seam in #40165.

Design: the server owns credential resolution; the route stays dumb.

• packages/ai is unchanged. Bedrock keeps taking static credentials and never refreshes them, per its documented contract ("the consumer rebuilds the model").
• Model resolution runs before every provider turn (callModel → context.load → models.resolve), so credentials captured at model build time are never more than one turn old.
• ModelResolver.fromCatalogModel now finalizes Bedrock settings via withBedrockCredentials:
  1. configured apiKey or explicit credentials → untouched
  2. AWS_BEARER_TOKEN_BEDROCK → injected as apiKey (bearer)
  3. otherwise → AWS default chain via @aws-sdk/credential-providers (already a core dep), honoring settings.profile / AWS_PROFILE
• Chain providers are memoized per profile — fromNodeProviderChain caches and refreshes internally, so we don't re-walk SSO/IMDS every turn.
• The import is dynamic and only happens when a Bedrock model actually needs the chain; chain failure logs a warning and falls through to the route's existing "requires bearer auth or AWS credentials" error.
• Also restores the AWS_REGION env fallback the old AI SDK hook honored.

Covers both amazon-bedrock (Converse SigV4) and amazon-bedrock/mantle (SigV4 or bearer) specifiers.

Not in scope: cross-region inference-profile model-ID prefixing (resolveModelID) — tracked separately.

Checks

• bun typecheck (packages/core)
• bun test test/model-resolver.test.ts — 29 pass (chain fallback, bearer precedence, explicit-credentials passthrough)
• bun test test/generate.test.ts test/aisdk.test.ts test/aisdk-native.test.ts — 22 pass

Requested by: Aiden Cline (rekram1-node)