fix(aws): honour AWS_ENDPOINT_URL for aws4fetch-based resources

[sam-goodwin]

Summary

Fixes #1404 — aws4fetch-based AWS resources didn't pick up AWS_ENDPOINT_URL / AWS_ENDPOINT_URL_<SERVICE> after the SDK→aws4fetch migration, which blocked LocalStack / moto / motoserver workflows.

Adds an awsEndpoint(service, region) helper in alchemy/src/aws/utils.ts:

1. AWS_ENDPOINT_URL_<SERVICE> (e.g. AWS_ENDPOINT_URL_EC2) wins first
2. AWS_ENDPOINT_URL is the global fallback
3. Defaults to https://<service>.<region>.amazonaws.com

…and wires it into the three aws4fetch call sites that previously hardcoded the AWS host:

• callEC2Api (EC2: Vpc, Subnet, SecurityGroup, SecurityGroupRule, RouteTable, Route, RouteTableAssociation, NatGateway, InternetGateway, InternetGatewayAttachment)
• CloudControlClient.fetch (every aws/control/* resource)
• getAwsApiCaller (generic XML-API caller)

Also flips forcePathStyle: true on S3Client whenever an S3 endpoint override is in effect, since most emulators reject virtual-hosted-style — same trick the AWS CLI uses.

Usage

export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1
export AWS_ENDPOINT_URL=http://localhost:4566   # all services
# or, per-service:
export AWS_ENDPOINT_URL_EC2=http://localhost:5000

import alchemy from "alchemy";
import { Vpc } from "alchemy/aws/ec2";

const app = await alchemy("emulator-test");
await Vpc("v", { cidrBlock: "10.0.0.0/16" });
// → POST goes to http://localhost:4566/ (LocalStack), not real AWS
await app.finalize();

Test plan

• bun vitest run ./alchemy/test/aws/endpoint.test.ts — 8 new unit tests covering precedence (service-specific > global > default), trailing-slash stripping, hyphen→underscore env-var normalisation, and hasAwsEndpointOverride detection
• bun tsc --noEmit clean across alchemy/
• bun format clean
• Manual: point AWS_ENDPOINT_URL=http://localhost:4566 at a running LocalStack and exercise Vpc, an aws/control/* resource, and Bucket end-to-end

---

Generated by Claude Code