refactor: add aws-sdk auth mode and tighten provider auth

docs/bedrock.md

@@ -41,6 +41,7 @@ export AWS_BEARER_TOKEN_BEDROCK="..."
       "amazon-bedrock": {
         baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
         api: "bedrock-converse-stream",
+        auth: "aws-sdk",
         models: [
           {
             id: "anthropic.claude-3-7-sonnet-20250219-v1:0",
@@ -67,6 +68,9 @@ export AWS_BEARER_TOKEN_BEDROCK="..."
 
 - Bedrock requires **model access** enabled in your AWS account/region.
 - If you use profiles, set `AWS_PROFILE` on the gateway host.
+- Clawdbot surfaces the credential source in this order: `AWS_BEARER_TOKEN_BEDROCK`,
+  then `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY`, then `AWS_PROFILE`, then the
+  default AWS SDK chain.
 - Reasoning support depends on the model; check the Bedrock model card for
   current capabilities.
 - If you prefer a managed key flow, you can also place an OpenAI‑compatible