Propagates AWS credentials across all execution paths so Bedrock works
in CLI, gateway (Telegram/Discord/Slack/etc.), and subagent delegation.

- run_agent.py: add aws_access_key/secret/session_token/region params
  to AIAgent.__init__(); set api_mode="anthropic_messages" for bedrock;
  build AnthropicBedrock client in the anthropic_messages branch; pass
  is_bedrock to build_anthropic_kwargs() to preserve model IDs
- cli.py: skip api_key/base_url validation for bedrock; store AWS creds
  from runtime dict; pass them to AIAgent; include AWS fields in
  credentials_changed detection to handle STS token rotation
- gateway/run.py: propagate AWS fields from _resolve_runtime_agent_kwargs();
  pass them through _resolve_turn_agent_config(); bypass api_key guard
  for bedrock provider in all four check sites
- agent/smart_model_routing.py: include AWS fields in both primary
  passthrough runtime dicts so smart routing fallbacks keep credentials
- tools/delegate_tool.py: inherit AWS credentials from parent agent so
  subagents work under Bedrock
- hermes_cli/main.py: add _model_flow_bedrock() setup wizard — prompts
  for credentials, saves to .env, selects from curated model list or
  free-text ARN/custom ID; add "AWS Bedrock" to provider selection menu
- tests/conftest.py: clear AWS_ACCESS_KEY_ID/SECRET/SESSION_TOKEN/REGION
  in the autouse isolation fixture to prevent real credentials from
  interfering with provider auto-detection tests

Replace Bedrock-specific abstractions with generic ones so adding
Vertex, Azure AI Foundry, or similar platform-auth providers requires
minimal changes to the routing/plumbing layers.

Three key generalizations:

1. is_bedrock -> preserve_model_id (anthropic_adapter.py, run_agent.py)
   Platform-auth providers use opaque model IDs that must not be
   transformed. The flag name no longer references a specific provider.
   AIAgent derives this from _PLATFORM_AUTH_PROVIDERS at init time.

2. uses_platform_auth on ProviderConfig (auth.py)
   New boolean field replaces hardcoded != "bedrock" guard checks in
   cli.py and gateway/run.py. Runtime dicts carry the flag so consumers
   never need to import the registry. Adds is_platform_auth_provider()
   helper for convenience.

3. platform_credentials envelope (runtime_provider.py, cli.py,
   gateway/run.py, smart_model_routing.py, delegate_tool.py, run_agent.py)
   Replaces 4 flat aws_* fields with a single opaque dict that flows
   untouched through all routing layers. Only two endpoints unpack it:
   resolve_bedrock_credentials() (produces it) and
   build_anthropic_bedrock_client() (consumes it). Adding a new
   platform-auth provider now requires zero changes to the routing
   plumbing.

Replace the duplicated _PLATFORM_AUTH_PROVIDERS frozenset in
run_agent.py with a direct call to is_platform_auth_provider() from
hermes_cli/auth.py. No circular import risk since neither auth.py nor
runtime_provider.py imports run_agent at the module level.

Add AWS Profile and IAM instance role auth options to the bedrock
provider setup wizard. Users on EC2/ECS no longer need explicit
access keys. Also adds bedrock to _has_any_provider_configured
for IAM role detection.

- Add centralized _strip_region_prefix() helper for handling all known
  Bedrock region prefixes (us, eu, apac, global, us-gov, jp, au)
- Add base Claude 4 model entries to metadata table for prefix fallback
- Add property tests for all new region prefixes
- Fixes: global.anthropic.* models now correctly resolve metadata
  instead of falling back to generic 8192 max_output_tokens

- Add bedrock_converse branch to _trunc_content extraction in the finish_reason='length' block of run_conversation()
- Extracts text content from the normalized Bedrock response tuple (assistant_message.content) to detect when the model spent all output tokens on reasoning
- Add 3 unit tests: partial text (not exhausted), reasoning-only (exhausted), empty content (exhausted)
- Tests mock _interruptible_api_call directly with pre-normalized tuples, matching the pattern used by existing Nous credential refresh tests

…Bedrock models via AWS credentials'

…arsing

- Parse foundation-model and inference-profile ARNs to extract model IDs for metadata lookup
- Pass through opaque application-inference-profile ARNs (fall back to auto-detect)
- Add has_bedrock_model_metadata() helper for setup wizard to check resolvability
- Prompt for context_length when model metadata is unknown (matches custom endpoint flow)
- Extract _parse_token_count() shared helper supporting k/K/m/M suffixes (e.g. 200k, 1.2M)
- Replace inline int() parsing in both custom endpoint and Bedrock setup flows

…ResponseStream in addition to vanilla bedrock:InvokeModel during setup flow.

- Remove redundant cross-region duplicates from metadata table (_strip_region_prefix handles these)
- Fix aliases to resolve to base model IDs instead of hardcoding us. prefix
- Add short-name entries for inference profile resolution (e.g. anthropic.claude-sonnet-4-6)
- Expand metadata table with tool-capable models from Bedrock inference profiles
- Fix test_cross_region_prefix_preserved to not depend on prefixed metadata entries

…port

# Conflicts:
#	agent/anthropic_adapter.py
#	agent/smart_model_routing.py
#	cli.py
#	gateway/run.py
#	hermes_cli/auth.py
#	hermes_cli/main.py
#	pyproject.toml
#	run_agent.py
#	tests/conftest.py
#	tools/delegate_tool.py
#	uv.lock