feat(frontend): manage Cognito users and groups, and test sign-in

The Cognito panel gains a test sign-in that shows the decoded ID and
access token claims, a groups section, and a per-user panel to enable or
disable, confirm, sign out everywhere, reset or set a password and change
group membership.

Delete confirmations (row and bulk) now say what else goes, driven by
the schema's deleteImpact, and the inspector follows list refreshes
instead of the click-time snapshot.

packages/frontend/src/components/DynamicResourceView.tsx

@@ -23,6 +23,7 @@ import { StorageObjectBrowser } from "@/components/StorageObjectBrowser";
 import { S3BucketWebsitePanel } from "@/components/S3BucketWebsitePanel";
 import { ComputePanel, LaunchInstanceForm } from "@/components/ComputePanel";
 import { NetworkingPanel } from "@/components/NetworkingPanel";
+import { describeDeleteImpact } from "@/lib/deleteImpact";
 import { getPath } from "@/lib/resourcePath";
 import {
   capabilityEnabled,
@@ -574,12 +575,14 @@ export function DynamicResourceView({
   const resources = resourcesQuery.data ?? [];
   const canCreate = schema.actions.includes("create");
   const canDelete = schema.actions.includes("delete");
+  const deleteImpactText = describeDeleteImpact(schema.deleteImpact, selectedItems);
   const isAllSelected =
     resources.length > 0 &&
     resources.every((r) => selectedItems.some((s) => s.id === r.id));
+  // Prefer the latest listed copy, so the inspector follows refreshes instead of the click-time snapshot.
   const activeSelected =
     selected?.cloud === cloud && selected.service === service
-      ? selected
+      ? resources.find((resource) => resource.id === selected.id) ?? selected
       : undefined;
   const runtimeReachable = cloudStatus?.runtime === "reachable";
   const resourceCapabilityInputs =
@@ -744,6 +747,9 @@ export function DynamicResourceView({
                   {canDelete && (
                     deleteConfirm ? (
                       <>
+                        {deleteImpactText && (
+                          <span className="delete-impact" role="status">{deleteImpactText}</span>
+                        )}
                         <button
                           className="button danger"
                           type="button"