Swap auth to cognito - project access control from RDS

[alasdairwilson]

• Added Cognito auth flow (login/callback/logout) and JWT validation.
• Added DB-backed user lookup + allowed project lookup.
• we cache this db return for a bit to prevent constant calls
• Enforced access server-side in callbacks (client login state no longer trusted except for visual button state).
• Refactored auth/access logic into dedicated modules.
• Fixed direct URL project selection when access is controlled so URL is not overwritten on initial load.
• Added token-exchange error handling.

[lithomson]

Nice to see the auth/access logic separated into dedicated modules — feels much easier to follow.
Caching the user lookup also seems like a sensible way to avoid repeated DB calls during auth/access checks.
Looks good overall to me.