Add Grok 4.3 (xAI) to Bedrock model selection

## Summary

Grok 4.3 from xAI became available on Amazon Bedrock on **June 15, 2026**, but it is not yet listed in the application's model definitions.

A recent audit of the model list in `packages/libs/core/src/bedrock-models.ts` confirms that all other recently-released models are already present:

| Model | Status |
|-------|--------|
| Claude Sonnet 5 (`global.anthropic.claude-sonnet-5`) | ✅ Already added |
| GPT-OSS 120B (`openai.gpt-oss-120b-1:0`) | ✅ Already added |
| GPT-OSS 20B (`openai.gpt-oss-20b-1:0`) | ✅ Already added |
| **Grok 4.3 (xAI)** | ❌ **Missing** |

---

## Model Details

| Field | Value |
|-------|-------|
| Provider | xAI |
| Available on Bedrock since | June 15, 2026 |
| Bedrock model ID | TBD — needs verification via `aws bedrock list-foundation-models` (likely `xai.grok-4-3` or similar) |

> **Note:** The exact Bedrock model ID should be confirmed before implementation. Run:
> ```bash
> aws bedrock list-foundation-models --query 'modelSummaries[?contains(modelId, `grok`)]'
> ```

---

## Implementation Approach

### 1. Extend the provider union type (if using Converse API)

In `packages/libs/core/src/bedrock-models.ts`, the `BedrockModelDefinition.provider` field is typed as:
```ts
readonly provider: 'Anthropic' | 'Amazon' | 'Qwen' | 'OpenAI';
```

If Grok 4.3 is served via the Converse API, add `'xAI'` to this union. If it is served via the Bedrock–OpenAI compatible surface (`bedrock-openai` endpoint) or the Mantle endpoint, the existing `endpoint` field handles routing and `'OpenAI'` may be reused as the provider label — check the Bedrock SDK surface for Grok 4.3 first.

The same provider union also appears in:
- `packages/frontend/src/config/models.ts` (`BedrockModel.provider`)
- `packages/frontend/src/components/ui/ModelReasoningSelector/`
- `packages/backend/src/routes/trigger-schemas.ts` (Zod schema)

All four locations must be kept in sync.

### 2. Add the model entry

```ts
// packages/libs/core/src/bedrock-models.ts — BEDROCK_MODEL_DEFINITIONS array
{
id: 'xai.grok-4-3', // ← verify exact Bedrock model ID
name: 'Grok 4.3',
provider: 'xAI', // ← or 'OpenAI' if routed via bedrock-openai endpoint
maxOutputTokens: 32768, // ← verify from AWS model card
// endpoint: 'bedrock-openai', // ← add if not on Converse API
},
```

### 3. Mirror in CDK config

Per the comment at the top of `bedrock-models.ts`, every entry must also be added to `DEFAULT_CONFIG.bedrockModels` in `packages/cdk/config/environment-utils.ts`. CDK intentionally does not import `@moca/core`, so this is a manual sync step:

```ts
// packages/cdk/config/environment-utils.ts
{ id: 'xai.grok-4-3', name: 'Grok 4.3', provider: 'xAI' },
```

### 4. IAM permissions

If Grok 4.3 requires the `bedrock-openai` or `mantle` endpoint, verify that `deriveBedrockIamResources()` in `packages/cdk/lib/constructs/api/backend-api.ts` generates the correct IAM statements (e.g. `bedrock:CallWithBearerToken` and the appropriate foundation-model ARN pattern).

---

## Priority / Impact

- **Impact:** Medium-high — Grok 4.3 is a capable frontier model; adding it expands user choice alongside the existing Claude, Nova, Qwen, and OpenAI offerings.
- **Effort:** Low — the pattern is already established for OpenAI-endpoint models (`gpt-oss-*`). The main unknown is the exact model ID and endpoint type.
- **Risk:** Low — purely additive change; no existing functionality is affected.

## Acceptance Criteria

- [ ] Exact Bedrock model ID confirmed
- [ ] `BedrockModelDefinition.provider` union updated (if needed)
- [ ] Entry added to `BEDROCK_MODEL_DEFINITIONS` in `packages/libs/core/src/bedrock-models.ts`
- [ ] Entry mirrored in `DEFAULT_CONFIG.bedrockModels` in `packages/cdk/config/environment-utils.ts`
- [ ] CDK IAM resources verified/updated
- [ ] Unit tests in `packages/libs/core/src/__tests__/bedrock-models.test.ts` pass
- [ ] Model appears in UI model selector

Start by running the provided aws bedrock list-foundation-models query to verify Grok 4.3's model ID and endpoint. Then inspect packages/libs/core/src/bedrock-models.ts, packages/cdk/config/environment-utils.ts, the frontend and backend provider definitions, and deriveBedrockIamResources() in packages/cdk/lib/constructs/api/backend-api.ts. Done means the model is consistently configured, permitted, selectable in the UI, and packages/libs/core/src/__tests__/bedrock-models.test.ts passes.

Written by the indexing model from the issue text.