refactor(iam): split long IAM ops in roles, account, and oidc

[vieiralucas]

Summary

Five long IAM functions had clear logical phases buried in their bodies.

• `delete_role`: extract `ensure_role_can_be_deleted` (instance profile, managed policy, inline policy guards), mirroring the same pattern `delete_user` uses. `delete_role` drops to a 4-line operation.
• `create_service_linked_role`: the 30-line role-name derivation match (with hard-coded casing for `autoscaling`/`elasticbeanstalk`/etc and the `.` fan-out) becomes `derive_service_linked_role_name`. Pure function, easy to test, easy to extend with new principals.
• `get_account_authorization_details`: the 222-line operation was four parallel XML builders for users, roles, groups, and policies. Move each into `build_user_details_xml` / `build_role_details_xml` / `build_group_details_xml` / `build_policy_details_xml`. The operation body is now 'snapshot state, build the four sections, format the envelope.'
• `update_account_password_policy`: separate `validate_password_policy_inputs` (collects every constraint violation into a single multi-error ValidationError) from `apply_password_policy_updates` (applies provided fields onto the stored `AccountPasswordPolicy`).
• `create_oidc_provider`: the URL/thumbprint/client-id validation block is now `validate_oidc_provider_input` — a pure function that lets the operation body focus on parsing inputs, building the ARN, and inserting the provider.

No behavior change. Same lock semantics, same error wording, same XML output. The OIDC validator switches from a manual `loop+break` to `.iter().any()` which is the more idiomatic form.

Test plan

• `cargo fmt`
• `cargo clippy --workspace --all-targets -- -D warnings`
• `cargo test -p fakecloud-iam` (73 passed)

---

Summary by cubic

Refactored IAM operations in fakecloud-iam by extracting focused helpers to simplify complex functions and improve testability. No behavior changes; same locks, error messages, and XML outputs.

• Refactors
  • delete_role: extracted ensure_role_can_be_deleted (instance profile, managed/inline policy guards).
  • create_service_linked_role: extracted derive_service_linked_role_name (handles casing and prefix.service forms); pure.
  • get_account_authorization_details: split into build_user_details_xml, build_role_details_xml, build_group_details_xml, build_policy_details_xml.
  • update_account_password_policy: added validate_password_policy_inputs and apply_password_policy_updates; aggregates validation errors.
  • create_oidc_provider: added validate_oidc_provider_input; uses iter().any() for checks.

^{Written for commit 96fe87a. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files