feat(byok): support Bedrock API keys through Vercel

[chrarnoldus]

Summary

• Accept Bedrock API-key JSON ({"apiKey":"…","region":"us-east-1"}) alongside existing IAM credentials for Vercel user and organization BYOK.
• Share runtime validation between the credential dialog and Gateway conversion, rejecting mixed authentication methods and incomplete API-key credentials.
• Preserve encrypted storage, provider selection, and credential redaction; add regressions for validation, all three inference request formats, persistence/replacement, and logging.

Verification

No manual browser or live-provider tests were run; tests are delegated to CI as requested. No live Bedrock credentials were available.

Visual Changes

The existing AWS Bedrock credential dialog now explains both JSON formats and key expiration. No layout or component changes; screenshots not captured.

Reviewer Notes

• Formatting and git diff --check passed. Local lint and web typecheck timed out after 120 seconds each; CI is authoritative. The container has Node 22 rather than the required Node 24.
• No database migration or dependency changes.
• The payload follows the AI SDK Bedrock apiKey/region contract. Live Vercel Gateway compatibility is not verified; its BYOK credential table still lists IAM fields, although its Bedrock reranking note distinguishes API keys from SigV4 credentials.
• Existing credential-test fallback behavior and billing are unchanged.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Bedrock API-key BYOK validation, Vercel forwarding, persistence, and log redaction look correct with high confidence.

Files Reviewed (8 files)

• apps/web/src/components/organizations/byok/BYOKKeysManager.tsx
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/types.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.test.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.ts
• apps/web/src/lib/ai-gateway/rewriteModelResponse.test.ts
• apps/web/src/routers/byok-router.test.ts

---

_{Reviewed by grok-4.6 · Input: 119.9K · Output: 13.1K · Cached: 246.8K}

_{Review guidance: REVIEW.md from base branch main}