feat(guardrail): Bedrock prompt-injection guardrail for Fusion

Adds an Amazon Bedrock Guardrail (PROMPT_ATTACK, HIGH, input) plus a dedicated
least-privilege IAM user for Fusion's AWS-Guardrail integration, so the gateway
screens inbound prompts for injection/jailbreak before de-id or the agent run.
Outputs the region/id/version/access-key for the Fusion console (secret stays in
gitignored state). Verified live: benign -> NONE, injection -> GUARDRAIL_INTERVENED.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

terraform/guardrail.tf

@@ -0,0 +1,66 @@
+# ---------------------------------------------------------------------------
+# Amazon Bedrock Guardrail for Fusion's "AWS Guardrail" integration. This makes
+# the demo a real AI-gateway policy: Fusion calls Bedrock ApplyGuardrail on the
+# traffic (independent of the model) to screen for PROMPT INJECTION / jailbreak.
+#
+# Fusion (shared SaaS) needs static AWS creds, so we mint a dedicated IAM user
+# scoped to bedrock:ApplyGuardrail on THIS guardrail only. In the Fusion console
+# you enter: region, guardrail id, guardrail version, access key, secret key.
+# ---------------------------------------------------------------------------
+
+resource "aws_bedrock_guardrail" "injection" {
+  name                      = "${local.name}-injection"
+  description               = "Prompt-injection / jailbreak screening for the HNCB AI gateway demo."
+  blocked_input_messaging   = "Blocked by the HNCB AI gateway guardrail: this request looks like a prompt-injection attempt."
+  blocked_outputs_messaging = "Blocked by the HNCB AI gateway guardrail."
+
+  # Prompt-attack detection is input-only, so output_strength must be NONE.
+  content_policy_config {
+    filters_config {
+      type            = "PROMPT_ATTACK"
+      input_strength  = "HIGH"
+      output_strength = "NONE"
+    }
+  }
+
+  tags = local.cloud_tag
+}
+
+# A numbered, published version (Fusion needs id + version, not DRAFT).
+resource "aws_bedrock_guardrail_version" "injection" {
+  guardrail_arn = aws_bedrock_guardrail.injection.guardrail_arn
+  description   = "v1 - prompt attack HIGH"
+}
+
+# Dedicated IAM user for Fusion SaaS to call ApplyGuardrail (least privilege).
+resource "aws_iam_user" "fusion_guardrail" {
+  name = "${local.name}-fusion-guardrail"
+  tags = local.cloud_tag
+}
+
+resource "aws_iam_user_policy" "fusion_guardrail" {
+  name = "apply-guardrail"
+  user = aws_iam_user.fusion_guardrail.name
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["bedrock:ApplyGuardrail"]
+      Resource = [aws_bedrock_guardrail.injection.guardrail_arn]
+    }]
+  })
+}
+
+resource "aws_iam_access_key" "fusion_guardrail" {
+  user = aws_iam_user.fusion_guardrail.name
+}
+
+# --- Values to paste into the Fusion AWS-Guardrail integration ---
+output "guardrail_region" { value = var.region }
+output "guardrail_id" { value = aws_bedrock_guardrail.injection.guardrail_id }
+output "guardrail_version" { value = aws_bedrock_guardrail_version.injection.version }
+output "fusion_guardrail_access_key_id" { value = aws_iam_access_key.fusion_guardrail.id }
+output "fusion_guardrail_secret_access_key" {
+  value     = aws_iam_access_key.fusion_guardrail.secret
+  sensitive = true
+}