provider: Bedrock hidden when AWS credentials exist but no AWS_* env var is exported

Problem

After #47436 and #47548, Bedrock is listed when any of these is present:

• AWS_BEARER_TOKEN_BEDROCK or a /connect API key (bearer)
• AWS_PROFILE, AWS_ACCESS_KEY_ID, AWS_WEB_IDENTITY_TOKEN_FILE, AWS_CONTAINER_CREDENTIALS_* (SigV4 via the AWS default chain)
• options.profile in opencode.json

Availability is a presence check on those signals. Two common setups have working AWS credentials but export none of them, so Bedrock stays hidden even though a request would succeed:

1. Bare [default] profile — aws login, aws sso login, or aws configure with no AWS_PROFILE exported.
2. EC2 instance role (IMDS) — credentials come from the instance metadata endpoint; there is no env var to detect. (#35798)

Related: #40663, #34997, #43681.

Workaround (works today)

Listing the provider in config force-enables it; the default chain then resolves credentials per request:

// opencode.json
{ "providers": { "amazon-bedrock": {} } }
// or with a named profile
{ "providers": { "amazon-bedrock": { "options": { "profile": "work" } } } }

Proposed: /connect amazon-bedrock → "AWS credentials"

Add a second connect method alongside the existing API key:

/connect amazon-bedrock
  ├─ API key                 (exists)
  └─ AWS credentials         (new)
       Profile: [________]   optional; blank = default chain
       → run the AWS default chain once to verify
         ok   → store credential, Bedrock listed
         fail → surface the SDK error (e.g. "session expired, run aws login")

Shape:

• Stored credential holds only { profile? } — no AWS secrets, no expiry, no refresh. packages/ai already builds a fresh chain per request, so rotation and re-login are picked up without restart.
• Needs a credential shape for "credentials live outside opencode". Options: a new external credential type (reuse the oauth/auto connect UI as the Azure CLI method does, no client changes), or make key optional on the key method and add a profile field (one screen, touches the key form in app/cli/tui).
• model-resolver injects nothing for such a credential; profile flows into settings through metadata as it does today.

Not proposed

• Probing the chain at startup or in available() to auto-detect these cases. It does file/network I/O on a hot path and swallows errors; the explicit connect step is preferable.
• Auto-running aws sso login on expiry (#1934) — separate feature.