feat: add multi-region resource scopes to contexts

[youngjinjung-linq]

Problem

A unic context currently binds one AWS identity to one resource region. Users operating the same account and role across several regions must duplicate contexts, which mixes authentication identity with resource browsing state.

Proposed behavior

Separate the durable authentication identity from its resource scope:

• Keep SSO portal region independent from resource regions.
• Let one context define a default resource region and an allowed list of resource regions.
• Preserve existing region / sso_region configurations through backward-compatible loading.
• Let users switch the active resource region without logging in again or changing account/role.
• Remember the active region while unic is running and clearly display it.
• Keep single-region behavior as the default; aggregated all-region service queries are follow-up scope unless they fit cleanly without duplicating every service implementation.

Example

contexts:
  - name: production
    auth_type: sso
    sso_start_url: https://example.awsapps.com/start
    sso_region: us-east-1
    sso_account_id: "123456789012"
    sso_role_name: AdministratorAccess
    region: ap-northeast-2
    regions:
      - ap-northeast-2
      - us-east-1
      - eu-west-1

Acceptance criteria

• Context configuration supports multiple resource regions and a default region.
• Legacy contexts without regions behave exactly as before.
• TUI provides a region picker for configured regions.
• Region switching recreates AWS clients with existing credentials and does not trigger SSO login.
• Shell exports continue to use the selected/default single region.
• Tests and documentation cover configuration compatibility and region switching.

[youngjinjung-linq]

@Unic-bot: assign me

[github-actions]

@youngjinjung-linq has been assigned to this issue.