fix: mask Bedrock API Key as secret and support GovCloud regions

- Add isSecret: true to BEDROCK_API_KEY template value
- Update region regex to support multi-segment regions (us-gov-west-1)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/components/providers/forms/ProviderForm.tsx

@@ -543,7 +543,7 @@ export function ProviderForm({
     if (appId === "claude" && category === "cloud_provider") {
       // 验证 Region 格式
       const regionValue = templateValues.AWS_REGION?.editorValue?.trim() || "";
-      const regionPattern = /^[a-z]{2}-[a-z]+-\d+$/;
+      const regionPattern = /^[a-z]{2}(-[a-z]+)+-\d+$/;
       if (!regionPattern.test(regionValue)) {
         toast.error(
           t("providerForm.invalidRegion", {

src/config/claudeProviderPresets.ts

@@ -565,6 +565,7 @@ export const providerPresets: ProviderPreset[] = [
         placeholder: "your-bedrock-api-key",
         editorValue: "",
         optional: true,
+        isSecret: true,
       },
       AWS_ACCESS_KEY_ID: {
         label: "Access Key ID",