feat(probes): add Bedrock, Vertex and Azure probe kinds - #48

This adds the Bedrock, Vertex and Azure probe kinds to src/main/probes/ so runProbe() no longer returns "No probe implemented" for provider ids bedrock, vertex and azure-openai. It is the probe-layer slice of the wider work tracked on the parent issue; vault storage for the Vertex project and region, the renderer Keys step fields, and CLI parity stay for later runs.

Closes #47

Verification

• mise run ci:app passed in this worktree (typecheck, lint, unit tests including the new cloud probe cases, and the full build).
• mise run ci:cli passed (typecheck and compiled CLI build). The CLI keeps its existing behaviour in this PR because cli/src/lib/probes.ts is a separate implementation; parity there is a follow-up in the independent CLI flow.
• The new tests first failed against the pre-change build with dist/main/probes/aws.js missing, then passed after the implementation and rebuild.

Proof comes from a logic-only slice with mocked HTTP and no live provider keys. The fixture server in scripts/test-probes-cloud.mjs records each request and returns canned responses, and the run below is part of npm test.

  ✓ aws no credentials returns invalid
  ✓ aws mocked 200 returns ok
  ✓ aws request path is /foundation-models
  ✓ aws Authorization uses SigV4 credential scope
  ✓ aws credential scope names region and bedrock service
  ✓ aws mocked 403 returns invalid
  ✓ aws detail surfaces the AWS error code
  ✓ gcp missing project and region returns error
  ✓ gcp missing config makes no HTTP request
  ✓ gcp mocked 200 returns ok
  ✓ gcp request path carries project and region
  ✓ gcp mocked 403 returns invalid
  ✓ azure missing endpoint returns error
  ✓ azure mocked 200 returns ok
  ✓ azure request sends the api-key header
  ✓ azure mocked 401 returns invalid
  ✓ runProbe dispatches bedrock to the aws probe
  ✓ runProbe dispatches vertex to the gcp probe
  ✓ runProbe dispatches azure-openai to the azure probe
  ✓ runProbe still reports unimplemented providers

all cloud probe cases passed

Reviewer notes

• No live Bedrock, Vertex or Azure call was made. Confirming the SigV4 signature, the Vertex token path and the Azure deployment list against real accounts still needs real cloud credentials; the tests prove the request shape, the signed header format and the result mapping against the mocked fixture.
• Bedrock credentials come from the environment chain (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, optional AWS_SESSION_TOKEN; region from AWS_REGION or AWS_DEFAULT_REGION, default us-east-1). There is no new dependency and no AWS SDK. The shared credentials file and SSO chain are not read in this slice.
• runProbe() for Bedrock ignores the vault apiKey field because Bedrock is a cloud_creds provider. The IPC handler still requires a key before probing, so end-to-end Validate wiring for the cloud providers lands with the vault and renderer work on the parent issue.
• Vertex treats the supplied key as an OAuth2 access token from ADC. Long-lived service-account key files are not parsed in this slice.
• The renderer has no visible change in this PR, so there is no screenshot. The only user-visible text change is the catalog note wording for the Bedrock and Vertex rows.