feat(frontend): manage Cognito users and groups, and test sign-in

The Cognito panel gains a test sign-in that shows the decoded ID and
access token claims, a groups section, and a per-user panel to enable or
disable, confirm, sign out everywhere, reset or set a password and change
group membership.

Delete confirmations (row and bulk) now say what else goes, driven by
the schema's deleteImpact, and the inspector follows list refreshes
instead of the click-time snapshot.

packages/frontend/src/lib/deleteImpact.ts

@@ -0,0 +1,25 @@
+import {getPath} from '@/lib/resourcePath'
+import type {CloudResource} from '@/types/resource'
+import type {ServiceSchema} from '@/types/schema'
+
+/**
+ * "This also deletes 2 users and 1 app client." for the delete confirmation,
+ * summed over the selected resources. A count is a number at the path, or the
+ * length of a list there; anything else, and zero counts, are left out.
+ */
+export function describeDeleteImpact(impact: ServiceSchema['deleteImpact'], resources: CloudResource[]): string | null {
+    if (!impact?.length) return null
+
+    const parts = impact.flatMap(({path, singular, plural}) => {
+        const total = resources.reduce((sum, resource) => {
+            const value = getPath(resource, path)
+            if (Array.isArray(value)) return sum + value.length
+            return typeof value === 'number' && Number.isFinite(value) ? sum + value : sum
+        }, 0)
+        return total > 0 ? [`${total} ${total === 1 ? singular : plural}`] : []
+    })
+    if (parts.length === 0) return null
+
+    const list = parts.length === 1 ? parts[0] : `${parts.slice(0, -1).join(', ')} and ${parts[parts.length - 1]}`
+    return `This also deletes ${list}.`
+}