feat(ui): canvas-first redesign with a self-hosted draw.io

The canvas now fills the window and the chat floats on its right. draw.io is
served from our own origin (public/drawio, downloaded at build time and
checked against the release's SHA-256), so the app can drive the editor
directly:

- every AI change becomes a version card with a thumbnail; compare, restore
  or undo it, and Ctrl+Z on the canvas takes an AI change back in one step
- shapes the AI just changed are highlighted on the canvas
- selected shapes appear as a chip and are sent to the model
- the app's own canvas toolbar, shape library and page tabs replace
  draw.io's chrome
- new start screen, session rename and switcher, open .drawio files
- settings split into Models & keys, Appearance, Advanced and About
- Bedrock in the model settings also takes an API key instead of access keys
- phones switch between canvas and chat
- dark mode keeps the diagram on a white sheet and no longer flashes

With an external draw.io (NEXT_PUBLIC_DRAWIO_BASE_URL) the app falls back to
draw.io's own toolbar and the features above that need same origin are off.

The chat logic moved from the 1500-line chat panel into a chat engine plus
small UI components; zustand holds canvas, versions, settings and UI state.

components/provider-credentials-fields.tsx

@@ -53,6 +53,9 @@ interface ProviderCredentialsFieldsProps {
     name?: string
     baseUrl?: string
     awsRegion?: string
+    // Bedrock: also offer an API key (the user dialog; the admin panel
+    // stores access keys only)
+    bedrockApiKey?: boolean
     disabled?: boolean
     // Update a plain text field
     onChange: (field: "name" | "baseUrl" | "awsRegion", value: string) => void
@@ -72,6 +75,7 @@ export function ProviderCredentialsFields({
     name,
     baseUrl,
     awsRegion,
+    bedrockApiKey,
     disabled,
     onChange,
     renderSecret,
@@ -112,6 +116,26 @@ export function ProviderCredentialsFields({
 
             {provider === "bedrock" ? (
                 <>
+                    {/* Bedrock API key: used instead of the access keys */}
+                    {bedrockApiKey && (
+                        <div className="space-y-2">
+                            <Label
+                                htmlFor="bedrock-api-key"
+                                className="text-xs font-medium flex items-center gap-1.5"
+                            >
+                                <Key className="h-3.5 w-3.5 text-muted-foreground" />
+                                {dict.modelConfig.bedrockApiKey}
+                            </Label>
+                            {renderSecret({
+                                field: "apiKey",
+                                id: "bedrock-api-key",
+                            })}
+                            <p className="text-xs text-muted-foreground">
+                                {dict.modelConfig.bedrockApiKeyHint}
+                            </p>
+                        </div>
+                    )}
+
                     {/* AWS Access Key ID */}
                     <div className="space-y-2">
                         <Label