[BYO-S3] Frontend: AWS IAM-role warehouse form

### Task Summary

Part of #6870. The UI for setting up an AWS (assume-role) warehouse.

- **Local vs Cloud form** — the `user-warehouse` create form gains a Local/Cloud selector. The
Cloud path calls `reserve-identity`, shows the platform principal ARN + the external ID for the
user to paste into their IAM role's trust policy, and takes the resulting role ARN.
- **Service wiring** — `warehouse.service.ts` gains the `reserveIdentity` call and surfaces
`externalId` on `WarehouseInfo` so the UI can re-display it; shared helpers in `warehouse.util.ts`.

### Task Type
- [x] Other (feature implementation)