discover: broaden discovery to feed the new drivers

Per the standing directive (dynamic discovery per credential type as each
driver lands):
- env.go: tag DB connection URLs by scheme (postgres/postgresql, mysql/mariadb,
  redis/rediss) with a user:password authority, routing DATABASE_URL/REDIS_URL/
  MYSQL_URL straight to the in-place DB drivers, kept regardless of the
  secret-name heuristic.
- aws.go: emit the driver-ready single-line blob (was the bare secret) and
  resolve region from env / ~/.aws/config.
- ssh.go: content-based key detection (not just id_*) + ~/.ssh/config
  IdentityFile parsing.
- tea.go: new scanner mapping Gitea `tea` CLI config to a driver-ready PAT blob.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/discover/aws.go

@@ -3,6 +3,7 @@ package discover
 import (
 	"bufio"
 	"context"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -14,6 +15,13 @@ func init() { Register(&awsScanner{}) }
 
 // awsScanner reads ~/.aws/credentials (INI). Read-only: opens O_RDONLY and never
 // writes back.
+//
+// The emitted secret is the driver-ready single-line blob
+// "aws://<AccessKeyId>:<SecretAccessKey>@aws/?region=<region>" (see
+// internal/rotate/aws.go), so a discovered key can be rotated directly in Mode B
+// (scan → migrate → rotate). The AccessKeyId is non-secret and stays full in the
+// blob (the rotation driver deletes the OLD key by id); Identity/Meta keep it
+// redacted for display.
 type awsScanner struct{}
 
 func (a *awsScanner) Name() string { return "aws" }
@@ -45,16 +53,24 @@ func (a *awsScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, er
 	var profile, keyID string
 
 	flush := func(secret string) {
-		if profile == "" || secret == "" {
+		if profile == "" || secret == "" || keyID == "" {
 			return
 		}
+		// Driver-ready single-line blob; the secret lives only here (and the vault).
+		blob := (&url.URL{
+			Scheme:   "aws",
+			Host:     "aws",
+			User:     url.UserPassword(keyID, secret),
+			Path:     "/",
+			RawQuery: "region=" + url.QueryEscape(awsRegion(profile)),
+		}).String()
 		creds = append(creds, Credential{
 			Source:   a.Name(),
 			Kind:     KindAWSKey,
 			Identity: profile + " / " + redactMiddle(keyID),
 			Location: p,
 			Modified: fi.ModTime(),
-			Secret:   v.Store([]byte(secret)),
+			Secret:   v.Store([]byte(blob)),
 			Meta:     map[string]string{"access_key_id": redactMiddle(keyID)},
 		})
 		keyID = ""
@@ -85,6 +101,51 @@ func (a *awsScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, er
 	return creds, sc.Err()
 }
 
+// awsRegion resolves the signing region for a profile: AWS_REGION /
+// AWS_DEFAULT_REGION env first, then the `region` key under the matching profile in
+// ~/.aws/config (or AWS_CONFIG_FILE), defaulting to us-east-1. Read-only.
+func awsRegion(profile string) string {
+	if r := os.Getenv("AWS_REGION"); r != "" {
+		return r
+	}
+	if r := os.Getenv("AWS_DEFAULT_REGION"); r != "" {
+		return r
+	}
+	cfg := os.Getenv("AWS_CONFIG_FILE")
+	if cfg == "" {
+		home, _ := os.UserHomeDir()
+		cfg = filepath.Join(home, ".aws", "config")
+	}
+	f, err := os.Open(cfg) // read-only
+	if err != nil {
+		return "us-east-1"
+	}
+	defer f.Close()
+
+	// In ~/.aws/config non-default profiles are headed "[profile NAME]"; default is
+	// "[default]".
+	want := "profile " + profile
+	if profile == "default" {
+		want = "default"
+	}
+	inSection := false
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		line := strings.TrimSpace(sc.Text())
+		if strings.HasPrefix(line, "[") && strings.HasSuffix(line, "]") {
+			inSection = strings.TrimSpace(line[1:len(line)-1]) == want
+			continue
+		}
+		if !inSection {
+			continue
+		}
+		if k, val, ok := splitKV(line); ok && strings.ToLower(k) == "region" && val != "" {
+			return val
+		}
+	}
+	return "us-east-1"
+}
+
 func splitKV(line string) (k, v string, ok bool) {
 	i := strings.IndexByte(line, '=')
 	if i < 0 {