Tool call attribution and Bedrock provider support

Features

• Added AWS Bedrock as a cloud LLM provider, including credential UX, DSML filtering, and onboarding polish.
• Added an OpenAI-compatible Embeddings API, with case-insensitive keyword matching and a restricted embeddings provider picker.
• Added sub-call tracing for run_script tool calls and a thread-first Recent Activity panel to aid debugging.
• Marked all MCP catalog entries as experimental except GitHub.

Improvements

• Flagged unavailable credentials to the agent directly in the system prompt.
• Tightened loop detection in the coordinator, fixed silent-death paths, and corrected browser tool documentation.
• Clarified run_script args vs. process.env usage and fixed the browser_evaluate schema in tool docs.
• Explained ownership reasons in register_script edit-denied errors.
• OAuth token refresh now uses Basic Auth, with credential status surfaced in the agent system prompt.

Fixes

• Fixed tool calls rendering under the user turn instead of the assistant turn, and restored assistant attribution for tool accordions.
• Merged consecutive tool micro-turns into a single accordion for cleaner chat display.
• Embedded sub-calls in sandbox error results for run_script-based tools.
• Fixed the coordinator’s loop detector to compare exact text rather than number-normalized text.
• Corrected repo references in docs so workers and npm packages point to auxot-server.