feat(api): add Cognito user pools to the cloud explorer

Adds a userpools catalog entry, schema and AwsUserPoolsAdapter, verified
against Floci core:

- list/get/create/delete user pools; create can set email or username
  sign-in, a relaxed password policy for local test users, and a public
  app client (on by default) whose id is surfaced in the pool metadata
- users as the pool's child items: list (paged), get, create and delete;
  passwords are set permanent by default so users can sign in at once
- map Cognito's HTTP-400 error names (UserNotFoundException,
  UsernameExistsException, AliasExistsException, InvalidPasswordException)
- link Floci's cognito-idp service to the new page on the diagnostics page

packages/api/src/cloud-spi/serviceCatalog.ts

@@ -239,6 +239,13 @@ export const SERVICE_CATALOG = {
         // AWS retains its dedicated page while Azure and GCP use Cloud Explorer.
         routeByCloud: {aws: '/secretsmanager'},
     },
+    userpools: {
+        displayName: 'User Directories',
+        displayNameByCloud: {aws: 'Cognito'},
+        iconKey: 'userpools',
+        group: 'Security',
+        order: 7,
+    },
     iac: {
         displayName: 'Infrastructure as Code',
         displayNameByCloud: {aws: 'CloudFormation'},