[BYO-S3] Frontend: AWS IAM-role warehouse form

[mengw15]

Task Summary

Part of #6870. The UI for setting up an AWS (assume-role) warehouse.

• Local vs Cloud form — the user-warehouse create form gains a Local/Cloud selector. The
  Cloud path calls reserve-identity, shows the platform principal ARN + the external ID for the
  user to paste into their IAM role's trust policy, and takes the resulting role ARN.
• Service wiring — warehouse.service.ts gains the reserveIdentity call and surfaces
  externalId on WarehouseInfo so the UI can re-display it; shared helpers in warehouse.util.ts.

Task Type

• Other (feature implementation)