feat: allow short-term bearer tokens for opencode bedrock user

[xnoto]

Summary

Flex/Priority service tiers for Claude models are only selectable via service_tier in the Anthropic Messages API surface on bedrock-runtime (/anthropic/v1/messages). That surface authenticates with Bedrock API keys (bearer tokens), not SigV4 — InvokeModel/Converse reject non-Standard tiers for Anthropic models (verified empirically in us-west-2/us-east-1/us-east-2).

This adds bedrock:CallWithBearerToken so the opencode-bedrock user can use short-term (12h, client-side presigned, permission-inheriting) bearer tokens, hardened with bedrock:bearerTokenType = SHORT_TERM so long-term API keys remain forbidden.

Validation

• make test — all canonical pre-commit hooks pass
• Additive IAM statement only; CI plan authoritative

Post-merge test plan: presign a short-term token from the user's credentials and call /anthropic/v1/messages with \"service_tier\": \"flex\" on Opus 4.6; the response echoes the served tier.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # aws_iam_user_policy.bedrock_opencode will be updated in-place
  ~ resource "aws_iam_user_policy" "bedrock_opencode" {
        id     = "opencode-bedrock:bedrock-invoke"
        name   = "bedrock-invoke"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (3 unchanged elements hidden)
                    {
                        Action   = [
                            "bedrock:ListModelInvocationJobs",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "ListBatchJobs"
                    },
                  ~ {
                      ~ Action    = [
                          - "aws-marketplace:ViewSubscriptions",
                          - "aws-marketplace:Subscribe",
                          + "bedrock:CallWithBearerToken",
                        ]
                      ~ Condition = {
                          ~ StringEquals = {
                              - "aws:CalledViaLast"       = "bedrock.amazonaws.com"
                              + "bedrock:bearerTokenType" = "SHORT_TERM"
                            }
                        }
                      ~ Sid       = "MarketplaceModelSubscription" -> "AllowShortTermBearerToken"
                        # (2 unchanged attributes hidden)
                    },
                  ~ {
                      ~ Action    = [
                          - "s3:GetObject",
                          - "s3:PutObject",
                          - "s3:ListBucket",
                          + "aws-marketplace:ViewSubscriptions",
                          + "aws-marketplace:Subscribe",
                        ]
                      + Condition = {
                          + StringEquals = {
                              + "aws:CalledViaLast" = "bedrock.amazonaws.com"
                            }
                        }
                      ~ Resource  = [
                          - "arn:aws:s3:::mitw-bedrock-batch",
                          - "arn:aws:s3:::mitw-bedrock-batch/*",
                        ] -> "*"
                      ~ Sid       = "BatchDataS3Access" -> "MarketplaceModelSubscription"
                        # (1 unchanged attribute hidden)
                    },
                  - {
                      - Action    = [
                          - "iam:PassRole",
                        ]
                      - Condition = {
                          - StringEquals = {
                              - "iam:PassedToService" = "bedrock.amazonaws.com"
                            }
                        }
                      - Effect    = "Allow"
                      - Resource  = "arn:aws:iam::332355796717:role/bedrock-batch-inference"
                      - Sid       = "PassBatchServiceRole"
                    },
                  + {
                      + Action   = [
                          + "s3:GetObject",
                          + "s3:PutObject",
                          + "s3:ListBucket",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::mitw-bedrock-batch",
                          + "arn:aws:s3:::mitw-bedrock-batch/*",
                        ]
                      + Sid      = "BatchDataS3Access"
                    },
                  + {
                      + Action    = [
                          + "iam:PassRole",
                        ]
                      + Condition = {
                          + StringEquals = {
                              + "iam:PassedToService" = "bedrock.amazonaws.com"
                            }
                        }
                      + Effect    = "Allow"
                      + Resource  = "arn:aws:iam::332355796717:role/bedrock-batch-inference"
                      + Sid       = "PassBatchServiceRole"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.