feat(frontend): manage Cognito users and groups, and test sign-in

The Cognito panel gains a test sign-in that shows the decoded ID and
access token claims, a groups section, and a per-user panel to enable or
disable, confirm, sign out everywhere, reset or set a password and change
group membership.

Delete confirmations (row and bulk) now say what else goes, driven by
the schema's deleteImpact, and the inspector follows list refreshes
instead of the click-time snapshot.

packages/frontend/src/lib/deleteImpact.test.ts

@@ -0,0 +1,22 @@
+import {expect, test} from 'vitest'
+import {describeDeleteImpact} from './deleteImpact'
+import type {CloudResource} from '@/types/resource'
+
+const impact = [
+    {path: 'metadata.estimatedNumberOfUsers', singular: 'user', plural: 'users'},
+    {path: 'metadata.appClients', singular: 'app client', plural: 'app clients'},
+]
+
+function pool(users: unknown, clients: unknown[]): CloudResource {
+    return {id: 'p', name: 'p', cloud: 'aws', service: 'userpools', type: 'user-pool', region: null, createdAt: null, metadata: {estimatedNumberOfUsers: users, appClients: clients}}
+}
+
+test('sums numbers and list lengths across the selection', () => {
+    expect(describeDeleteImpact(impact, [pool(2, [{}]), pool(1, [])])).toBe('This also deletes 3 users and 1 app client.')
+})
+
+test('leaves out zero and unreadable counts', () => {
+    expect(describeDeleteImpact(impact, [pool(0, [{}, {}])])).toBe('This also deletes 2 app clients.')
+    expect(describeDeleteImpact(impact, [pool(null, [])])).toBeNull()
+    expect(describeDeleteImpact(undefined, [pool(5, [])])).toBeNull()
+})