Add AWS CLI v2 for headless SSO/Bedrock authentication

Includes device-code flow docs for browser-less SSO login from
remote/Docker environments.

Dockerfile

@@ -33,6 +33,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     sudo \
     locales \
     procps \
+    unzip \
     && ln -s /usr/bin/fdfind /usr/local/bin/fd \
     && rm -rf /var/lib/apt/lists/*
 
@@ -53,6 +54,18 @@ RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && \
 RUN npm install -g opencode-ai@${OPENCODE_VERSION} && \
     opencode --version
 
+# ── AWS CLI v2 (for SSO/Bedrock authentication) ─────────────────────
+RUN ARCH=$(case "${TARGETARCH}" in \
+      amd64) echo "x86_64" ;; \
+      arm64) echo "aarch64" ;; \
+      *) echo "x86_64" ;; \
+    esac) && \
+    curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-${ARCH}.zip" -o /tmp/awscli.zip && \
+    unzip -q /tmp/awscli.zip -d /tmp && \
+    /tmp/aws/install && \
+    rm -rf /tmp/aws /tmp/awscli.zip && \
+    aws --version
+
 # ── Optional: Python ─────────────────────────────────────────────────
 ARG INSTALL_PYTHON=false
 RUN if [ "${INSTALL_PYTHON}" = "true" ]; then \