feat(api): Cognito user actions, groups and test sign-in

Adds enable, disable, confirm, sign-out, password reset and set-password
for one user; user group membership; group list, create and delete; and a
test sign-in that returns decoded token claims. A refused test sign-in is
an outcome rather than a 401, which would end the console session.

Also adds a generic GET for one flat item and a schema deleteImpact so
delete confirmations can say what else goes with a resource.

packages/api/src/adapter-aws/awsErrors.ts

@@ -60,6 +60,7 @@ const CONFLICT_NAMES = new Set([
     'DeleteConflictException',
     'UsernameExistsException',
     'AliasExistsException',
+    'GroupExistsException',
 ])
 
 const ACCESS_DENIED_NAMES = new Set([