feat(claude-code): first-class anthropic_base_url, use_bedrock, use_vertex inputs

[morganl-ant]

Problem

Running Claude Code against Bedrock, Vertex AI, or a self-hosted gateway through this module currently requires the template author to know the exact Claude Code env var names (CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX, ANTHROPIC_BASE_URL) and wire them up as separate coder_env resources outside the module. The README Bedrock and Vertex examples are 30+ lines of copy-paste each, and they lead with static AWS access keys / GCP service-account JSON rather than the IAM-role / Workload Identity patterns most enterprise deployments actually use.

When configured this way, install.sh still prints "Note: Neither claude_api_key nor enable_aibridge is set, skipping authentication setup" on every workspace start, which reads to users as a misconfiguration even though their Bedrock/Vertex setup is correct (coder/coder#21835). There is also no way to point the module at a self-hosted Anthropic-protocol gateway short of enable_aibridge, which is Coder-specific (coder/coder#17402).

Changes

• New use_bedrock and use_vertex bool inputs that set CLAUDE_CODE_USE_BEDROCK=1 / CLAUDE_CODE_USE_VERTEX=1 via coder_env. Mutually exclusive with each other and with enable_aibridge.
• New anthropic_base_url string input that sets ANTHROPIC_BASE_URL for self-hosted gateways. Mutually exclusive with enable_aibridge. The existing coder_env.anthropic_base_url resource is widened to fire on either condition; AI Bridge keeps precedence for the value.
• install.sh: when any of the three new inputs is set, configure_standalone_mode prints a clear "Using Amazon Bedrock / Google Vertex AI / custom ANTHROPIC_BASE_URL; Anthropic API key not required" message and returns early, instead of the misleading "Neither claude_api_key nor enable_aibridge is set" note.
• README: Bedrock and Vertex sections rewritten around the new inputs, leading with attached IAM role / Workload Identity and showing static credentials only as a fallback. New "Usage with a custom API gateway" section. Troubleshooting note updated to list all five auth paths.
• Tests: 7 new terraform test runs (env var assertions + 4 mutual-exclusion expect_failures); 3 new bun tests covering the install.sh message paths and coder_env outputs.

Validation

• terraform fmt -recursive clean
• terraform validate clean
• terraform test 26/26 pass
• shellcheck --severity=warning scripts/install.sh clean

Closes coder/coder#17402
Closes coder/coder#21835

Disclosure: I work at Anthropic on the Claude Code team.

[matifali]

Hi @morganl-ant I merged #861 so this needs rebase and a bit of refactor. Thanks