feat: add AWS Cognito authentication with optional user admin UI

[lart2150]

Offer Cognito as an alternative to Auth0. The CLI now asks for one authentication provider (None / Auth0 / Cognito), and Cognito is offered only when an AWS env is configured, since the CDK stack provisions the user pool.

• Add a CognitoAuth construct that provisions the user pool, managed login domain and branding, the app client, and branded invitation and verification emails, with optional SES sending
• Deliver the pool IDs to the app at runtime as /config.json, written by the bucket deployment, and load it in entry.ts before the app renders. Local dev reads the VITE_APP_COGNITO_* variables from the stack outputs
• Sign in through react-oidc-context with the shared AuthGuard and useAuthenticatedFetch, now templated per provider, and add a UserMenu with sign-out
• Optional cognito-admin feature: an identity pool scoped to an admin group, and /admin routes to list, create, edit, disable and reset users and to manage role membership through the Cognito admin API
• Validate the domain prefix against Cognito's reserved words and the length limit once the environment suffix is added
• test-synth takes a preset (none, auth0, cognito, cognito-admin) and synthesizes into test-synth-