PR 1: DI refactor (ssmAPI interface + cmd App holder)

[AbsolutOD]

Summary

PR 1 of 2 implementing the DI and tests spec at docs/superpowers/specs/2026-05-08-di-and-tests-design.md.

This PR is purely structural — no behavior changes on the happy path. It introduces the dependency-injection seams that PR 2 will exploit for unit tests.

• Commit 1 (chore: fix stale pinpt/esp imports in tests) — restore green test suite by fixing stale pinpt/esp imports left over from the rebrand (PR Rebrand: pinpt/esp → AbsolutOD/esp + LICENSE/README refresh #29).
• Commit 2 (refactor(ssm,client): introduce ssmAPI interface and collapse Service constructor) — extract unexported ssmAPI interface inside internal/ssm; Service holds api ssmAPI; collapse Service.New+Init into one constructor; client.New adapts to the new return signature. The spec listed these as two commits but the plan combined them — splitting would break the build between commits.
• Commit 3 (refactor(cmd): introduce App holder, convert subcommands to constructor pattern, update tests) — introduce cmd.App holder; convert all 8 subcommands to newXCmd(*App) constructor pattern with extracted runX functions; remove the package-level esp, c, and verbose globals; update existing tests for new pure-helper signatures.
• Commit 4 (docs: update CLAUDE.md for App holder pattern and DI seams) — refresh architecture, "Adding a subcommand", and testing notes sections to reflect the App-holder pattern (caught during code review — was misdirecting against the new structure).

PR 2 will add unit tests against the new seams.

Test plan

• go build ./... clean
• go vet ./... clean
• go test ./... green (existing tests preserved through signature updates)
• esp --help works without AWS env vars set
• esp version with missing AWS_DEFAULT_REGION returns exit 1 with the env-var error
• esp invocations behave identically to pre-refactor on the happy path against real AWS (manual smoke test)

Notes for review

• The ssmAPI interface is structurally a superset of the SDK's awsssm.GetParametersByPathAPIClient, so the same s.api value is passed to awsssm.NewGetParametersByPathPaginator.
• runX extraction is uniform across all subcommands for a uniform test contract, even where the body is 1-3 lines (copy, move, delete, version).
• The Service.Region field is now write-only — kept exported for the moment to avoid expanding scope. Worth unexporting in a future cleanup.