[P0] Bedrock first-invoke smoke test + Anthropic use-case form

[ausbru87]

AWS retired the per-model approval page in late 2025. Bedrock auto-enables on first invocation, but first-time Anthropic-on-Bedrock users get prompted for a one-page use-case form — fill it once, approval is typically minutes.

Depends on: cluster install (so the `coder-bedrock` IAM user exists).

Steps

```bash
source .env

1. Trigger first invoke + (if first time on Anthropic) the use-case form

aws --profile sandbox --region us-east-1 bedrock-runtime invoke-model \
--model-id anthropic.claude-sonnet-4-20251022-v1:0 \
--content-type application/json \
--body '{"anthropic_version":"bedrock-2023-05-31","max_tokens":50,"messages":[{"role":"user","content":"say hi in 5 words"}]}' \
/tmp/bedrock-out.json

2. If you get AccessDeniedException with a use-case-form pointer:

open "$(cd terraform && terraform output -raw bedrock_model_catalog_url)"

Click into Claude Sonnet 4, fill the 1-page form, wait minutes for approval.

3. Re-run step 1 to confirm.

```

Verify in cluster

After Bedrock works at the IAM-user level, also confirm AI Gateway can invoke (this is the actual demo path):

```bash
oc -n coder logs deploy/coder | grep -i bedrock | tail -20

Should NOT show AccessDenied or 403 errors

```

Acceptance criteria

• `bedrock-runtime invoke-model` returns content (not AccessDeniedException)
• Use-case form (if prompted) submitted and approved
• Coder server logs show no Bedrock auth failures after AI Gateway provider is configured

Reference: `docs/aws-creds.md` §AWS Bedrock.