[FEAT] Implement AWS SigV4 auth for the AWS-family connectors

[AtelyPham]

Summary

The 8 AWS-family connectors declare auth.kind: 'api-key' with no credentialPlacement, so the declarative-REST runtime signs nothing and sends Authorization: Bearer <api-key>. AWS requires an AWS4-HMAC-SHA256 SigV4 signature, so every request is rejected. The adapter comments and connect hint describe a "gateway signs requests with SigV4 using the credential bundle in the api-key field" — that gateway was never built. This issue implements the real thing.

Evidence

Bearer-not-SigV4 chain (src/connectors/adapters/declarative-rest.ts):

• :195 — applyCredentials defaults to { kind: 'bearer' } when no credentialPlacement is set.
• :271-272 — credentialToken returns credentials.apiKey verbatim (no parse into accessKeyId / secret / region).
• :265 — emits headers.authorization = `Bearer ${token}` `.
• :250-256 — resolveBaseUrl falls back to a fixed host (e.g. https://sqs.us-east-1.amazonaws.com); metadata.endpoint is never populated for api-key, so region selection is dead.

Credential model can't hold the inputs:

• src/connectors/types.ts:133-138 — api-key credentials = { apiKey: string }.
• :396-400 — ApiKeyAuthSpec = { kind, hint }. "access key + secret + region" lives only in the hint string.

Misleading comments / hint:

• src/connectors/adapters/amazon-sqs.ts:5-6 (the "gateway signs requests with SigV4" comment) and :22 (the hint). Same pattern across the sibling adapters.

Scope — 8 connectors (all api-key, default Bearer placement)

Connector	Adapter
Amazon SQS	src/connectors/adapters/amazon-sqs.ts
Amazon SNS	amazon-sns.ts
Amazon SES	amazon-ses.ts
Amazon S3	amazon-s3.ts
Amazon Bedrock	amazon-bedrock.ts
Amazon Secrets Manager	amazon-secrets-manager.ts
Amazon Textract	amazon-textract.ts
Backblaze (B2, S3-compatible)	backblaze.ts

Plan

• SigV4 signer in the declarative-REST path — add a credentialPlacement: { kind: 'aws-sigv4', service, region } branch in applyCredentials that computes the AWS4-HMAC-SHA256 Authorization header (canonical request → string-to-sign → signing key) at fetch time. One signer serves all 8 adapters.
• Capture credential components — extend ConnectorCredentials / ApiKeyAuthSpec to hold accessKeyId + secretAccessKey + region (+ optional endpoint). Two routes to decide:
  • JSON-bundle parse inside the single api-key field (keeps the change mostly in agent-integrations), or
  • a multi-field credential form (cleaner UX, but adds an adc-side change to ApiKeyConnectModal.tsx + hub-contract.ts + hub-substrate.ts — would be a linked adc PR).
• Region → endpoint binding — populate metadata.endpoint (or derive host from region) so resolveBaseUrl stops defaulting to us-east-1.
• Fix the misleading hint + comments on all 8 adapters to describe the real auth flow.

Acceptance criteria

• An AWS-family connector connects end-to-end with real credentials and issues a correctly-signed (SigV4) request that AWS accepts.
• Region is selectable / correct (not hardcoded us-east-1).
• Adapter hints/comments accurately describe the auth flow.