The Bedrock create form required both access_key and access_key_secret, blocking deployments that authenticate against AWS through an IAM role, instance profile, or AWS_PROFILE. The backend already accepts a Bedrock provider that is configured by region alone (see codersdk.AIProviderBedrockSettings.IsConfigured), so the UI was the only thing standing between the operator and a working IAM-role provider.

The Yup schema now treats both fields as optional while keeping the cross-validation that forces the pair to travel together. A descriptive note under the inputs tells the operator that leaving both blank falls back to ambient AWS credentials, and links to the Amazon Bedrock section of the AI Gateway providers docs for the credential chain and IAM permissions. The mapping into CreateAIProviderRequest already omits empty credential fields, so the wire payload sends only region, model, and small_fast_model, which is enough for IsConfigured() on the backend.

The model and small-fast model fields are now pre-filled with the modern Sonnet 4.5 and Haiku 4.5 IDs from codersdk.aiGatewayBedrockModel / codersdk.aiGatewayBedrockSmallFastModel, matching the legacy environment seed path. A second docs note under those fields points at the AWS Bedrock model cards page so operators can find the canonical model IDs without leaving the form. This also addresses the AIGOV-411 ask.

Adds providerFormValuesToCreate coverage for the no-credential and whitespace-only paths, plus three new ProviderForm stories: one that verifies the model fields pre-fill, one that submits without static credentials, and one that verifies a half-typed credential pair stays blocked.

Closes CODAGT-626. Partial coverage for AIGOV-411 (model pre-fill plus docs link; combobox, model ID pattern validation, and docs site updates remain).

The Slack thread also flagged a separate edit-time regression: "if I go to edit an existing provider, all the fields I set are not on the UI." I did not see that reproduce against the masked-credential edit story, and the issue description focuses on the create flow, so I left it for a separate investigation rather than bundling it into this fix.

_{This PR was created by a Coder Agent on behalf of @dannykopping.}