Bug/ai assistant config (#939)

* revert(agent): restore plain AWS_* Bedrock credential handling

Undoes the credential-name change from #937 (ae489cfd) in both Bedrock
clients (lib/agent/composer/client.ts and the invoice-inbox extractor).
The BEDROCK_AWS_* rename assumed Vercel/Lambda shadows AWS_*, but the
plain AWS_* client ran on prod for six weeks (since #584), so it was
never shadowed. The current assistant outage predates #937 and is
environmental (prod AWS credentials / Bedrock access), not this code.
Leaves the unrelated JournalEntryForm.tsx change from #937 intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(agent): log real Bedrock failure + credential-load diagnostics

When someone uses the agent, surface why it fails on prod instead of the
opaque "request ended without sending any chunks":

- client.ts getAnthropic(): on cold start, log the resolved region and
  whether the AWS key/secret loaded from env (error-level if missing),
  plus the 4-char access-key-id prefix (AKIA = our IAM key, ASIA = a
  platform/STS credential) and whether a session token is present. No
  secret is logged.
- run-turn.ts: on a stream failure, extract err.status / err.code /
  err.cause / err.stack explicitly. The logger keeps only name+message
  from an Error and drops the stack in production, so the true failure
  (auth 403 vs bad region/model 400 vs throttle 429 vs transport cut)
  was invisible until now.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/agent/chat/run-turn.ts

@@ -301,11 +301,42 @@ export async function runChatTurn(args: RunTurnArgs): Promise<void> {
       // Surface as a chat error so the UI clears its streaming state. Re-throw
       // to let the route's outer try/catch persist the failure if needed.
       // Normalize Bedrock throttling/timeout/5xx into a friendly Swedish line.
+      //
+      // Extract status/code/cause/stack explicitly: the logger keeps only
+      // name/message/code from an Error and drops the stack in production, so
+      // the real failure was invisible (every prod log just said "request ended
+      // without sending any chunks"). These fields tell us whether the empty
+      // stream is auth (403), bad model/region (400), throttling (429), or a
+      // genuine transport cut. No secrets: AWS/SDK errors carry none, and the
+      // logger still redacts personnummer/UUIDs from any string.
+      const bedrockErr = err as {
+        status?: number
+        code?: string
+        cause?: unknown
+        stack?: string
+      }
+      let errCause: string | undefined
+      try {
+        errCause =
+          bedrockErr?.cause != null
+            ? String(
+                bedrockErr.cause instanceof Error
+                  ? `${bedrockErr.cause.name}: ${bedrockErr.cause.message}`
+                  : bedrockErr.cause,
+              ).slice(0, 300)
+            : undefined
+      } catch {
+        errCause = '[uninspectable cause]'
+      }
       log.error('Bedrock stream failed', err, {
         conversationId,
         companyId,
         model,
         iterations,
+        errStatus: typeof bedrockErr?.status === 'number' ? bedrockErr.status : undefined,
+        errCode: typeof bedrockErr?.code === 'string' ? bedrockErr.code : undefined,
+        errCause,
+        errStack: typeof bedrockErr?.stack === 'string' ? bedrockErr.stack.slice(0, 1200) : undefined,
       })
       emit({ kind: 'error', message: friendlyModelError(err) })
       throw err