Add AgentCore WebRTC example with KVS managed TURN

[wirjo]

Summary

• Adds a new deployment example (aws-agentcore-webrtc-kvs) that uses Amazon Kinesis Video Streams for TURN credential provisioning instead of non-AWS TURN providers
• Eliminates external dependencies for NAT traversal by fetching temporary, auto-rotating TURN credentials via the KVS GetIceServerConfig API
• Both the agent and server dynamically call KVS at connection time — no static TURN URLs or credentials to manage

Key changes

• agent/pipecat-agent.py and server/server.py: Added get_kvs_ice_servers() that calls DescribeSignalingChannel → GetSignalingChannelEndpoint → GetIceServerConfig
• scripts/setup-iam-role.sh: Added KVSTurnCredentials IAM policy for KVS access
• Replaced ICE_SERVER_URLS/ICE_SERVER_USERNAME/ICE_SERVER_CREDENTIAL env vars with a single KVS_CHANNEL_NAME
• VPC resource tags use -kvs- suffix to avoid conflicts with the existing aws-agentcore-webrtc example

Test plan

• Deploy with ./scripts/configure.sh and ./scripts/launch.sh
• Verify KVS signaling channel is auto-created on first connection
• Confirm WebRTC connection establishes with KVS TURN relay (check chrome://webrtc-internals for relay candidate type)
• Test in both VPC and PUBLIC modes

🤖 Generated with Claude Code

[kompfner]

Nice! It looks like the code in this PR is mostly just a copy-paste of the base WebRTC example, with the KVS changes applied on top.

If so: note that a few changes to the WebRTC example (only small things) landed after the changes in this PR, so we might want to "rebase" this PR to pick those up.

[kompfner]

Maybe we should also mention in the README (and/or env.example, after the changes from #196 have been applied) that these permissions are also required for the AWS account the server is running under.

[wirjo]

Addressed both points:

1. Rebased onto latest main to pick up all changes from AWS AgentCore examples cleanup #196 — the KVS files now match the updated base (Settings-based API for TTS/LLM, agent gets AWS creds from IAM role, simplified server CORS, AWS_SESSION_TOKEN support, production-readiness note, etc.)

2. Added server-side KVS permissions note — the server/env.example now documents that the server's AWS account also needs KVS permissions, and the README includes a callout in the server env vars section pointing back to the same KVS IAM policy.

Also removed "Pipecat Cloud" references from comments per separate request.

[kompfner]

Looks great! 👏