feat(frontend): manage Cognito users and groups, and test sign-in

The Cognito panel gains a test sign-in that shows the decoded ID and
access token claims, a groups section, and a per-user panel to enable or
disable, confirm, sign out everywhere, reset or set a password and change
group membership.

Delete confirmations (row and bulk) now say what else goes, driven by
the schema's deleteImpact, and the inspector follows list refreshes
instead of the click-time snapshot.

packages/frontend/src/components/ResourceTable.tsx

@@ -1,6 +1,7 @@
 import {useState} from 'react';
 import {Link} from 'react-router-dom';
 import {Pencil, Trash2} from 'lucide-react';
+import {describeDeleteImpact} from '@/lib/deleteImpact';
 import type {CloudResource} from '@/types/resource';
 import type {ServiceSchema} from '@/types/schema';
 import {getPath} from '@/lib/resourcePath';
@@ -140,6 +141,7 @@ export function ResourceTable({
                           className="table-confirm-actions"
                           onClick={(e) => e.stopPropagation()}
                         >
+                          <DeleteImpact schema={schema} resource={resource} />
                           <button
                             className="button danger compact"
                             type="button"
@@ -207,3 +209,8 @@ function CopyableColumnValue({resource, column}: {resource: CloudResource; colum
     </span>
   );
 }
+
+function DeleteImpact({schema, resource}: {schema: ServiceSchema; resource: CloudResource}) {
+  const text = describeDeleteImpact(schema.deleteImpact, [resource]);
+  return text ? <span className="delete-impact" role="status">{text}</span> : null;
+}