fix: grant CreateTokenVault and wire OAuth providers table to app-api

[philmerrell]

Summary

• Add bedrock-agentcore:CreateTokenVault to the AppApi task role. The first CreateOauth2CredentialProvider call in a region implicitly provisions the default token vault, so without this action the very first connector creation returns 500 with AccessDeniedException. Once the vault exists, subsequent calls would have succeeded — but the dev environment hit this on the first attempt.
• Wire DYNAMODB_OAUTH_PROVIDERS_TABLE_NAME into the AppApi container env. The IAM grant (line 883) and SSM lookup (line 220) were already there from feat: external MCP connectors via AgentCore Identity #174; only the env passthrough was missing. Without it, OAuthProviderRepository logs WARNING: ... repository is disabled at startup and the post-AgentCore DB write in create_provider() would fail, triggering the orphan-rollback path.

Context

Found while debugging a 500 on POST /admin/oauth-providers/ in the dev-ai account. CloudWatch (/ecs/dev-boisestateai-v2/app-api) showed:

botocore.errorfactory.AccessDeniedException: ... is not authorized to perform:
bedrock-agentcore:CreateTokenVault on resource:
arn:aws:bedrock-agentcore:us-west-2:490617140655:token-vault/default

Test plan

• cd infrastructure && npm install (local node_modules is on aws-cdk-lib@2.220.0 but pinned to 2.248.0; pre-existing, blocks cdk synth until synced)
• npx cdk diff dev-boisestateai-v2-AppApiStack --profile dev-ai — confirm only the IAM policy and env var change
• npx cdk deploy dev-boisestateai-v2-AppApiStack --profile dev-ai
• Retry POST /admin/oauth-providers/ from the admin UI — expect 201 and a row in the OAuth providers DynamoDB table
• Verify in CloudWatch that the DYNAMODB_OAUTH_PROVIDERS_TABLE_NAME not set warning is gone on next task start

🤖 Generated with Claude Code