Add Bedrock Mantle with native IAM credentials and GPT/Claude routing

[edwardsb]

Adds PGBOT_AI_PROVIDER=bedrock (alias mantle) for AWS Bedrock Mantle, with bearer-token authentication or native IAM credentials from the AWS SDK credential chain, including AWS_PROFILE.

• Routes openai.* models through the existing Responses client and anthropic.* models through the Messages client.
• Defaults to openai.gpt-5.6-terra. Region selection uses AWS_REGION, then AWS_DEFAULT_REGION, then the SDK configuration for IAM authentication, then us-east-1.
• Accepts PGBOT_AI_API_KEY or AWS_BEARER_TOKEN_BEDROCK; otherwise derives short-lived bearer tokens locally from AWS credentials. IAM authentication restricts requests to the configured regional Mantle HTTPS endpoint, and redirects are disabled.
• Recognizes the openai. model prefix for reasoning models, omits temperature for those models, and retains the upstream Responses token-budget floor and store=false behavior.

export PGBOT_AI_PROVIDER=bedrock
export AWS_PROFILE=my-profile
export AWS_REGION=us-east-1
export PGBOT_AI_MODEL=openai.gpt-5.6-terra
pgbot ask "What needs attention?" --url "$DATABASE_URL"

Validation: go test ./..., go test -race ./..., go vet ./..., and a static CLI build. Tests cover Responses request shape, IAM profile credentials, token signing and expiry, endpoint restrictions, redirect handling, and GPT/Claude routing.

[edwardsb]

hey @alexshapalov , I work mostly in AWS and I am in the progress of standing up pgbot mcp server in https://github.com/obot-platform/obot using their MCP Gateway. I needed a way for pgbot to use AWS Bedrock via IAM. This is working in my environment, so let me know what you think. Thanks.