refactor(iam): extract helpers from delete_user, update_user, create_access_key

[vieiralucas]

Summary

Three IAM user mutations were carrying enough inline detail to obscure their top-level intent.

• `delete_user`: the four 'cannot delete with X attached' guards (access keys, group membership, managed policies, inline policies) each produced their own `DeleteConflict` with a different remediation hint. Move the four checks into `ensure_user_can_be_deleted` so the `delete_user` body reads as 'check the entity exists, ensure it can be removed, then drop the rows from each keyed-by-username state map'.
• `update_user`: the rename branch laboriously rewrote five different state maps plus group memberships in line. Move that into `rename_user_references` so `update_user` only handles the user record itself; `rename_user_references` is a single helper that knows about every user-keyed state map and is the place to extend if a new one is added.
• `create_access_key`: the `UserName` parameter is optional, and the fallback (look up the calling user via their access key id) was taking up half the function. Move it into `resolve_create_access_key_target` so the operation body just resolves the target user, runs the limit check, and persists the new key.

No behavior change. Same lock semantics, same error messages.

Test plan

• `cargo fmt`
• `cargo clippy --workspace --all-targets -- -D warnings`
• `cargo test -p fakecloud-iam` (73 passed)

---

Summary by cubic

Extracted helpers from IAM user mutations to simplify the code and make intent clear. No behavior changes; errors and locking remain the same.

• Refactors
  • delete_user: moved dependency checks into ensure_user_can_be_deleted, preserving per-case DeleteConflict messages.
  • update_user: moved rename side-effects into rename_user_references to update all user-keyed maps and group memberships in one place.
  • create_access_key: moved optional UserName resolution into resolve_create_access_key_target, falling back to the caller’s access key ID.

^{Written for commit 607bd45. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file