Bug/ai assistant config (#939)

* revert(agent): restore plain AWS_* Bedrock credential handling

Undoes the credential-name change from #937 (ae489cfd) in both Bedrock
clients (lib/agent/composer/client.ts and the invoice-inbox extractor).
The BEDROCK_AWS_* rename assumed Vercel/Lambda shadows AWS_*, but the
plain AWS_* client ran on prod for six weeks (since #584), so it was
never shadowed. The current assistant outage predates #937 and is
environmental (prod AWS credentials / Bedrock access), not this code.
Leaves the unrelated JournalEntryForm.tsx change from #937 intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(agent): log real Bedrock failure + credential-load diagnostics

When someone uses the agent, surface why it fails on prod instead of the
opaque "request ended without sending any chunks":

- client.ts getAnthropic(): on cold start, log the resolved region and
  whether the AWS key/secret loaded from env (error-level if missing),
  plus the 4-char access-key-id prefix (AKIA = our IAM key, ASIA = a
  platform/STS credential) and whether a session token is present. No
  secret is logged.
- run-turn.ts: on a stream failure, extract err.status / err.code /
  err.cause / err.stack explicitly. The logger keeps only name+message
  from an Error and drops the stack in production, so the true failure
  (auth 403 vs bad region/model 400 vs throttle 429 vs transport cut)
  was invisible until now.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

extensions/general/invoice-inbox/lib/extract-invoice-fields.ts

@@ -246,18 +246,7 @@ export async function extractInvoiceFields(
     return { data: emptyResult(), rawText: null }
   }
 
-  // Prefer BEDROCK_AWS_* over the plain AWS_* names: on Vercel/Lambda the
-  // platform injects its own reserved AWS_* execution-role vars that shadow
-  // whatever is configured, so a hosted deploy must use the BEDROCK_AWS_* names
-  // (see lib/agent/composer/client.ts for the full explanation).
-  const awsRegion =
-    process.env.BEDROCK_AWS_REGION || process.env.AWS_REGION || 'eu-north-1'
-  const awsAccessKey =
-    process.env.BEDROCK_AWS_ACCESS_KEY_ID || process.env.AWS_ACCESS_KEY_ID
-  const awsSecretKey =
-    process.env.BEDROCK_AWS_SECRET_ACCESS_KEY || process.env.AWS_SECRET_ACCESS_KEY
-
-  if (!awsAccessKey || !awsSecretKey) {
+  if (!process.env.AWS_ACCESS_KEY_ID || !process.env.AWS_SECRET_ACCESS_KEY) {
     log.warn('AWS Bedrock credentials missing: returning empty extraction', {
       file_name_hash: createHash('sha256').update(input.fileName).digest('hex').slice(0, 12),
     })
@@ -265,9 +254,9 @@ export async function extractInvoiceFields(
   }
 
   const client = new AnthropicBedrock({
-    awsRegion,
-    awsAccessKey,
-    awsSecretKey,
+    awsRegion: process.env.AWS_REGION || 'eu-north-1',
+    awsAccessKey: process.env.AWS_ACCESS_KEY_ID,
+    awsSecretKey: process.env.AWS_SECRET_ACCESS_KEY,
   })
 
   let rawText: string | null = null