fix(security): accept AWS European Sovereign Cloud regions in validateAwsRegion

eusc-de-east-1 is a real Bedrock-enabled region that the existing pattern
did not cover, so applying the validator to bedrockRegion would have
rejected a config that worked before. Adds the eusc-<country> partition.

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.test.ts

@@ -1460,6 +1460,19 @@ describe('validateAwsRegion', () => {
     })
   })
 
+  describe('valid European Sovereign Cloud regions', () => {
+    it.concurrent('should accept eusc-de-east-1', () => {
+      const result = validateAwsRegion('eusc-de-east-1')
+      expect(result.isValid).toBe(true)
+      expect(result.sanitized).toBe('eusc-de-east-1')
+    })
+
+    it.concurrent('should reject a malformed eusc region', () => {
+      expect(validateAwsRegion('eusc-de-east').isValid).toBe(false)
+      expect(validateAwsRegion('eusc-deu-east-1').isValid).toBe(false)
+    })
+  })
+
   describe('valid China regions', () => {
     it.concurrent('should accept cn-north-1', () => {
       const result = validateAwsRegion('cn-north-1')

apps/sim/lib/core/security/input-validation.ts

@@ -856,6 +856,7 @@ export function validateAirtableId(
  * - ISO partitions: us-iso-east-1, us-iso-west-1, us-isob-east-1
  * - Mexico: mx-central-1
  * - EU Sovereign Cloud: eu-isoe-west-1
+ * - European Sovereign Cloud: eusc-de-east-1
  *
  * @param value - The AWS region to validate
  * @param paramName - Name of the parameter for error messages
@@ -881,7 +882,7 @@ export function validateAwsRegion(
   }
 
   const awsRegionPattern =
-    /^(eu-isoe|us-isob|us-iso|us-gov|af|ap|ca|cn|eu|il|me|mx|sa|us)-(central|north|northeast|northwest|south|southeast|southwest|east|west)-\d{1,2}$/
+    /^(eu-isoe|eusc-[a-z]{2}|us-isob|us-iso|us-gov|af|ap|ca|cn|eu|il|me|mx|sa|us)-(central|north|northeast|northwest|south|southeast|southwest|east|west)-\d{1,2}$/
 
   if (!awsRegionPattern.test(value)) {
     logger.warn('Invalid AWS region format', {