fix(kiro): validate region to prevent SSRF (GHSA-6mwv-4mrm-5p3m)

Reject non-AWS region values before interpolating them into upstream
URLs and stop reflecting upstream response bodies to the client.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/oauth/kiro/api-key/route.js

@@ -58,6 +58,10 @@ export async function POST(request) {
     });
   } catch (error) {
     console.log("Kiro API key import error:", error);
-    return NextResponse.json({ error: error.message }, { status: 500 });
+    // Do not reflect upstream response body to the client (SSRF hardening)
+    return NextResponse.json(
+      { error: "API key validation failed" },
+      { status: 500 }
+    );
   }
 }