feat(auth): harden AWS deployment and Bedrock E2E

[Naim-arg]

Summary

Adds the authentication, deployment hardening, quota preflight, and bounded live-E2E readiness needed to validate OME MemoryGuard safely on AWS.

This is a draft. Live Amazon Bedrock inference remains blocked by the account's zero baseline quota and is not claimed as verified.

What changed

• Added Cognito JWT validation and fail-closed API authorization.
• Hardened API request limits, repository TLS behavior, and Bedrock embedding configuration.
• Expanded the SAM template for Cognito, API Gateway, Lambda, IAM, evidence storage, and deployment safeguards.
• Added read-only Bedrock quota and AWS budget preflight scripts.
• Added a bounded synthetic Bedrock E2E runner that requires a short-lived token and a USD 5 budget gate.
• Improved the demo UI for risk decisions, reason codes, evidence state, human approval, retrieval, and audit events.
• Updated architecture, AWS deployment, verification, demo, security, and Devpost documentation.
• Added focused tests for authentication, API limits, repository behavior, embeddings, architecture, and E2E safety contracts.

Files changed

• Application: ome_memoryguard/api.py, auth.py, demo.py, embeddings.py, repository.py
• Infrastructure: template.yaml, .env.example
• Safety tooling: scripts/aws-cost-preflight.ps1, bedrock-quota-preflight.ps1, live-bedrock-e2e.ps1, sam-package.ps1
• Tests: tests/test_api.py, test_auth.py, test_architecture.py, test_embeddings.py, test_repository.py
• Documentation: README.md, SECURITY.md, and docs/*

Tests/checks run

• pytest: 51 passed
• Ruff: passed
• Python compileall: passed
• pip check: passed
• cfn-lint: passed
• SAM validate and local build: passed
• Gitleaks history and working-tree scans: passed
• PowerShell AST parsing: passed
• Fail-closed missing-token E2E gate: passed

Screenshots / manual verification

• Local demo UI manually exercised for safe, denied, pending-review, human-approval, and retrieval flows.
• Raw synthetic secret content was not displayed in denied output or audit history.
• No AWS deployment or live CockroachDB write was performed as part of this PR.

Risks / limitations

• Live Bedrock E2E is pending AWS Support activation of a non-zero Titan Text Embeddings V2 quota.
• The USD 5 AWS Budget check is a preflight/alert boundary, not an absolute provider-side hard cap.
• Production authentication/authorization and real-data handling are not claimed as verified.
• An upstream Starlette/TestClient deprecation warning remains.
• Current repository license is MIT; hackathon license requirements still need confirmation.

Rollback notes

Revert the eight commits in this branch or revert the eventual merge commit. No production resources, live schemas, or customer data were changed by this branch.