feat(api): add Cognito user pools to the cloud explorer

Adds a userpools catalog entry, schema and AwsUserPoolsAdapter, verified
against Floci core:

- list/get/create/delete user pools; create can set email or username
  sign-in, a relaxed password policy for local test users, and a public
  app client (on by default) whose id is surfaced in the pool metadata
- users as the pool's child items: list (paged), get, create and delete;
  passwords are set permanent by default so users can sign in at once
- map Cognito's HTTP-400 error names (UserNotFoundException,
  UsernameExistsException, AliasExistsException, InvalidPasswordException)
- link Floci's cognito-idp service to the new page on the diagnostics page

packages/api/src/adapter-aws/awsErrors.test.ts

@@ -127,3 +127,22 @@ describe('logs errors carry HTTP 400 and must not fall through to it', () => {
         expect(mapped?.status).toBe(409)
     })
 })
+
+/**
+ * Cognito reports every failure with HTTP 400, so these names must be mapped
+ * explicitly or a missing user would read as a validation error.
+ */
+describe('cognito errors carry HTTP 400 and keep their meaning', () => {
+    const cases: Array<[string, CloudErrorStatus]> = [
+        ['UserNotFoundException', 404],
+        ['UsernameExistsException', 409],
+        ['AliasExistsException', 409],
+        ['InvalidPasswordException', 400],
+    ]
+
+    for (const [name, status] of cases) {
+        test(`${name} maps to ${status}`, () => {
+            expect(mapAwsSdkError(sdkError(name, {$metadata: {httpStatusCode: 400}}))?.status).toBe(status)
+        })
+    }
+})