Bug/ai assistant config (#939)

* revert(agent): restore plain AWS_* Bedrock credential handling

Undoes the credential-name change from #937 (ae489cfd) in both Bedrock
clients (lib/agent/composer/client.ts and the invoice-inbox extractor).
The BEDROCK_AWS_* rename assumed Vercel/Lambda shadows AWS_*, but the
plain AWS_* client ran on prod for six weeks (since #584), so it was
never shadowed. The current assistant outage predates #937 and is
environmental (prod AWS credentials / Bedrock access), not this code.
Leaves the unrelated JournalEntryForm.tsx change from #937 intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(agent): log real Bedrock failure + credential-load diagnostics

When someone uses the agent, surface why it fails on prod instead of the
opaque "request ended without sending any chunks":

- client.ts getAnthropic(): on cold start, log the resolved region and
  whether the AWS key/secret loaded from env (error-level if missing),
  plus the 4-char access-key-id prefix (AKIA = our IAM key, ASIA = a
  platform/STS credential) and whether a session token is present. No
  secret is logged.
- run-turn.ts: on a stream failure, extract err.status / err.code /
  err.cause / err.stack explicitly. The logger keeps only name+message
  from an Error and drops the stack in production, so the true failure
  (auth 403 vs bad region/model 400 vs throttle 429 vs transport cut)
  was invisible until now.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/agent/composer/client.ts

@@ -1,4 +1,7 @@
 import AnthropicBedrock from '@anthropic-ai/bedrock-sdk'
+import { createLogger } from '@/lib/logger'
+
+const log = createLogger('agent-bedrock-client')
 
 let cached: AnthropicBedrock | null = null
 
@@ -20,19 +23,32 @@ let cached: AnthropicBedrock | null = null
 // API.
 export function getAnthropic(): AnthropicBedrock {
   if (cached) return cached
-  // Read Bedrock creds from BEDROCK_AWS_* first, falling back to the plain
-  // AWS_* names for local dev. On Vercel the functions run on AWS Lambda, whose
-  // runtime injects its OWN reserved AWS_REGION / AWS_ACCESS_KEY_ID /
-  // AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN for the platform execution role
-  // (wrong account, wrong region, no Bedrock access). Those shadow anything set
-  // in the dashboard, so a hosted deploy MUST use the BEDROCK_AWS_* names or the
-  // stream comes back empty ("request ended without sending any chunks").
-  const awsRegion =
-    process.env.BEDROCK_AWS_REGION || process.env.AWS_REGION || 'eu-north-1'
-  const awsAccessKey =
-    process.env.BEDROCK_AWS_ACCESS_KEY_ID || process.env.AWS_ACCESS_KEY_ID
-  const awsSecretKey =
-    process.env.BEDROCK_AWS_SECRET_ACCESS_KEY || process.env.AWS_SECRET_ACCESS_KEY
+  const awsRegion = process.env.AWS_REGION || 'eu-north-1'
+  const awsAccessKey = process.env.AWS_ACCESS_KEY_ID
+  const awsSecretKey = process.env.AWS_SECRET_ACCESS_KEY
+
+  // Startup diagnostic: make a hosted misconfiguration visible in the logs
+  // instead of it surfacing only as an opaque "request ended without sending
+  // any chunks" at stream time. Runs once per cold start (the client is cached).
+  // Never logs a secret: only the region, presence booleans, and the 4-char
+  // access-key-id PREFIX (AKIA = long-term IAM user key; ASIA = STS/temporary
+  // role credential, i.e. a platform-injected one rather than ours).
+  if (!awsAccessKey || !awsSecretKey) {
+    log.error('agent Bedrock credentials not loaded from env', undefined, {
+      region: awsRegion,
+      hasAccessKeyId: !!awsAccessKey,
+      hasSecretAccessKey: !!awsSecretKey,
+      regionFromEnv: !!process.env.AWS_REGION,
+    })
+  } else {
+    log.info('agent Bedrock client init', {
+      region: awsRegion,
+      keyPrefix: awsAccessKey.slice(0, 4),
+      hasSessionToken: !!process.env.AWS_SESSION_TOKEN,
+      regionFromEnv: !!process.env.AWS_REGION,
+    })
+  }
+
   // When both static keys are present, pass them. Otherwise omit them so the
   // SDK falls back to the AWS credential provider chain (instance profile,
   // IRSA, EKS pod identity, ...). The two-overload SDK refuses a mix.