setup/debug: Amazon Bedrock IAM policy for the add-in's inference-profile discovery + region-aware selection

[cschnidr]

What & why

The Claude for M365 add-in (Bedrock direct) now discovers permitted inference profiles via bedrock:ListInferenceProfiles at sign-in and selects a region-appropriate profile, instead of probing a hardcoded model ID. The generated ClaudeBedrockAccess IAM policy from this install tooling predates that behavior: it omits the discovery actions and only permits the us.anthropic.* profile prefix. As a result, the role is not compatible with the current add-in — discovery is denied and non-US regions can't invoke a valid profile.

This PR updates the generated policy and admin docs so the role works with the shipped add-in.

Related to #246, #217, #126 (the IAM/provisioning side of each).

Deployment ordering (important)
The IAM policy is a prerequisite for the current add-in build:

• The add-in calls ListInferenceProfiles at sign-in — denied unless this policy is applied → sign-in fails.
• Apply this policy (re-run :setup or update the role) before relying on the discovery-enabled add-in. New-policy + old-add-in is harmless; old-policy + new-add-in breaks sign-in.

Changes

setup.md

• IAM policy now grants bedrock:ListInferenceProfiles + bedrock:GetInferenceProfile (own statement, Resource: "*").
• Permits all five Anthropic inference-profile prefixes — us./eu./au./apac./global. — instead of only us.
• Invoke statement keeps the region-wildcard foundation-model/anthropic.* resource; cross-region inference requires both the inference-profile ARN and the foundation-model ARN.
  Admin guidance: IAM Resource list as the control plane for cost (restrict model family) and residency (restrict region prefix); in-region vs. cross-region-profile clarification; and a note that the shipped policy is intentionally permissive and should be tailored.

debug.md

• Generic "Sign-in 403: IAM policy too restrictive" troubleshooting entry — triage-table row + error-paste pattern — covering an over-narrow policy (missing discovery action or no invokeable profile for the region).

Scope / non-goals

Provisioning template + docs only. The add-in client behavior is out of scope (and already fixed upstream). No application code changes.

Testing

• Resolved IAM policy validated as JSON; confirmed the two discovery actions, all five prefixes, and the foundation-model resource are present.
• Internal doc anchors/links verified.