fix(auth): do not use SSO JSON region as Kiro API host

[BetterAndBetterII]

Summary

• Stop treating AWS SSO / credentials-file region as the Kiro/Q API region (fixes BUG: Region override from credentials file causes connection failure when non-us-east-1 region is unreachable #81).
• API hosts now come from a verified profile ARN, KIRO_API_REGION / api_region, or the default us-east-1.
• SSO region remains used only for OIDC refresh.

Test plan

• uv run pytest tests/unit/test_auth_manager.py -q (129 passed)
• New regression coverage for JSON region=eu-west-1 leaving API host at default
• Existing SSO/ARN/priority hierarchy tests updated for the corrected contract

[cla-bot]

Thanks for the PR! 🎉

Before merge, we need a one-time CLA confirmation.
It confirms that you have the right to contribute this code and allow the project to use it.

Full CLA text:
https://github.com/jwadow/kiro-gateway/blob/main/CLA.md

Please reply once with:

I have read the CLA and I accept its terms

You need to write once, all further messages from me can be ignored.

[BetterAndBetterII]

I have read the CLA and I accept its terms

[ankitcharolia]

@BetterAndBetterII could you give a try to this gateway: https://github.com/ankitcharolia/kiro-gateway

It works quite well with All AI harness and actively being developed. The most important thing is that it is ACP compliant