Implement AWS Bedrock provider with full credential config

[0xMMA]

Context

The v1 Rust/Tauri implementation had full Bedrock support via LangChain's BedrockChat — access key ID, secret access key, session token, region, inference profiles. The Go rewrite has a stub that returns an error.

Goal

Implement Bedrock as a fully working provider with proper AWS configuration, matching or exceeding v1 parity.

What's needed

• AWS SDK integration (no github.com/aws/* packages in go.mod currently)
• Expanded settings: access key ID, secret access key, session token, region, endpoint URL
• Key management needs to support multiple credentials per provider (currently 1:1)
• callBedrock() implementation in internal/features/enhance/service.go
• Settings UI fields for all AWS-specific config
• Inference profile support (v1 had region-aware defaulting: us.*, eu.*, apac.*)

Reference

• v1 implementation: archive/v1-tauri-rust/src/frontend/src/app/ (api-config component, langchain service)
• Current stub: internal/features/enhance/service.go:88-89
• Settings model already has AWSRegion field but no UI: internal/features/settings/model.go:8

Acceptance Criteria

• Bedrock provider works end-to-end for text enhancement
• All required AWS credentials configurable via settings UI and keyring
• Region and endpoint URL configurable
• Inference profile support