feat(api): Cognito user actions, groups and test sign-in

Adds enable, disable, confirm, sign-out, password reset and set-password
for one user; user group membership; group list, create and delete; and a
test sign-in that returns decoded token claims. A refused test sign-in is
an outcome rather than a 401, which would end the console session.

Also adds a generic GET for one flat item and a schema deleteImpact so
delete confirmations can say what else goes with a resource.

packages/api/src/adapter-aws/awsErrors.test.ts

@@ -137,6 +137,7 @@ describe('cognito errors carry HTTP 400 and keep their meaning', () => {
         ['UserNotFoundException', 404],
         ['UsernameExistsException', 409],
         ['AliasExistsException', 409],
+        ['GroupExistsException', 409],
         ['InvalidPasswordException', 400],
     ]