[Bug]: Claude shows "could not verify authentication status" on managed Bedrock installs

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

This shows up on managed Amazon Bedrock installs, where the credentials come from MDM/AWS rather than claude auth login.

1. Run Claude against Bedrock with managed credentials.
2. Open T3 and let the Claude provider status check run.
3. Look at the auth status.

checkClaudeProviderStatus decides auth state purely from the SDK capability-init probe. On managed Bedrock the probe comes back without any account info, so even though Claude is authenticated and working, T3 falls back to a warning and says it can't verify auth.

I've patched this locally: when the capability probe returns nothing, fall back to running claude auth status (with a 10s timeout), parse the JSON/text output to work out authenticated / unauthenticated / unknown, pull out apiProvider / authMethod / email when they're present, and label the Bedrock provider. "not logged in" style output maps to a clear error telling you to run claude auth login, and a timeout gets its own message.

Expected behavior

Claude should show as authenticated and labelled "Amazon Bedrock", since the credentials are valid and Claude itself uses them fine.

Actual behavior

T3 shows a warning — "Could not verify Claude authentication status from initialization result." — so a working provider looks unverified / unavailable. This doesnt stop requests from working.. But the model selector is disabled

Impact

Major degradation or frequent failure

Version or commit

main @ b125b7635

Environment

apps/server, Claude Agent provider. Managed Amazon Bedrock installs where SDK init returns no capabilities/account info.

Logs or stack traces

Screenshots, recordings, or supporting files

Workaround

None from the UI — the provider actually works, the status is just wrong.

Start in apps/server by locating checkClaudeProviderStatus and tracing how the SDK capability-init probe determines Claude authentication. Then inspect how the server can invoke and interpret claude auth status, including managed Bedrock credentials, timeout, provider labeling, and unauthenticated output. Done means valid Bedrock credentials show authenticated with the Amazon Bedrock label while failures produce distinct status messages.