fix(cognito): expire access tokens on first-party operations

[vieiralucas]

Summary (5.3, auth-when-enabled)

GetUser, ChangePassword, the MFA ops, branding, GlobalSignOut and the other first-party Cognito operations validated the bearer token with a bare access_tokens map lookup that never checked expiry — so an expired-but-not-revoked access token kept authorizing those operations indefinitely. (The API-Gateway authorizer path already fails closed on exp+sig; this was Cognito's own ops.)

Adds CognitoState::valid_access_token, which returns the token only if it exists AND was issued within the 1-hour TTL (the ExpiresIn: 3600 minted at sign-in), and routes all ~22 first-party handler lookups through it.

Non-code surface

No new API surface — enforcement correctness. No SDK/docs/metadata change applies (checked).

Test plan

• Unit test valid_access_token_rejects_expired (fresh accepted, >1h-old rejected, unknown rejected). Expiry is time-based so a unit test is the right level (an E2E would need a 1-hour wait).
• cargo test -p fakecloud-cognito --lib (337) passes; clippy clean.

---

Summary by cubic

Expire Cognito access tokens for first-party operations. Tokens older than 1 hour are now rejected for GetUser, ChangePassword, MFA, branding, and GlobalSignOut.

• Bug Fixes
  • Added CognitoState::valid_access_token with a 1-hour TTL check (ExpiresIn: 3600) to replace raw access token lookups.
  • Routed all first-party handlers through the new check, matching API Gateway authorizer behavior.
  • Added a unit test for fresh, expired, and unknown tokens.
  • No API changes.

^{Written for commit b526edc. Summary will update on new commits.}