feat: add Amazon Bedrock Mantle as a model provider

[philmerrell]

Overview

Adds Amazon Bedrock Mantle as a first-class model provider. Mantle is AWS's OpenAI-compatible inference surface for Bedrock-hosted open-weight models (Qwen, GPT-OSS, Gemma, DeepSeek, …). It's distinct from the existing bedrock provider because it speaks the OpenAI wire protocol with a short-term bearer token, not the Converse API with SigV4.

Admins can now browse Mantle models and add them via curated quick-add cards (with a manual escape-hatch form), and users can chat with them like any other managed model.

What's included

Backend (feat(models))

• apis/shared/bedrock/bearer_token.py — SigV4-presigned CallWithBearerToken bearer token, ported inline from aws-bedrock-token-generator (no new dependency), plus a region+path base-URL helper.
• GET /admin/mantle/models — browse the live regional Mantle roster via the OpenAI SDK.
• ModelProvider.MANTLE threaded end to end: model_config translation → agent_factory builds a Strands OpenAIModel against the Mantle base URL → BaseAgent + inference chat pipeline.
• mantle_endpoint_path on the managed-model shape, persisted and resolved server-authoritatively in _resolve_model_settings, and carried through the paused-turn snapshot for resume correctness.

Infra (feat(infra))

• Grants the bedrock-mantle:* IAM namespace (mirrors AWS-managed AmazonBedrockMantleInferenceAccess): CreateInference + Get*/List* + CallWithBearerToken on the runtime role; read-only + CallWithBearerToken on the app-API task role.

Frontend (feat(spa))

• A Bedrock Mantle catalog tab with curated cards (Qwen3 Coder 30B on /v1, Gemma 4 31B on /openai/v1), a Mantle-aware model form (endpoint-path selector, caching hidden, model-id datalist seeded from the live roster).

Key design decisions

• The endpoint path is recorded, not discovered. Mantle serves different models on different OpenAI-compatible paths (/v1 vs /openai/v1) and exposes no API to tell you which — verified against both the data plane (/v1/models returns only {id, created, object, owned_by}) and the absence of a bedrock-mantle boto3 control-plane client. We rejected both a maintained code-level mapping and runtime probing in favor of storing the path per model (sourced from the AWS model card, baked into curated cards, admin-settable in the escape hatch). The wrong path returns a misleading 401 "not enabled for this account" at chat time, so this matters.
• Caching is intentionally off for Mantle. Prompt caching on Bedrock is model-bound to Anthropic Claude + a few Amazon Nova models, none of which run through the Mantle provider. (Claude/Nova continue to use the bedrock provider where CacheConfig caching already works.)
• Curated-card data is verified: pricing against the AWS Bedrock pricing page (2026-06); modalities/capabilities/context/path against each model card.

Reviewer notes / deploy

• Two preconditions for cloud: (1) Bedrock Mantle must be enabled for the account in the target region (an AWS-console action, not a deploy); (2) platform.yml must deploy the bedrock-mantle:* IAM before inference works in cloud. Verified end-to-end locally against us-west-2 (token mint → /v1/models → chat completions on both /v1 and /openai/v1).
• Known Gemma-4 behavior (Chat Completions path): reasoning happens but its trace isn't returned (Responses-API only), and parallel tool calls aren't supported (one per turn).
• Follow-up (not in this PR): expose reasoning_effort as a tunable for Gemma — needs a small shared-catalog fix (number → select).

Testing

• Backend: 3861 passed, 3 skipped
• Frontend: 1216 passed
• Infra: tsc clean, integration 24 passed

🤖 Generated with Claude Code