feat(aws/cognito): add emailConfiguration to UserPool for SES-backed email delivery

[thiagofelix]

Let a Cognito user pool send its verification/OTP email through a verified SES identity natively — no customEmailSender Lambda required.

const identity = yield* SES.EmailIdentity("Sender", { emailIdentity: "example.com" });
// SES.EmailIdentityPolicy grants cognito-idp.amazonaws.com ses:SendEmail on the identity

const pool = yield* Cognito.UserPool("Users", {
  usernameAttributes: ["email"],
  autoVerifiedAttributes: ["email"],
  emailConfiguration: {
    emailSendingAccount: "DEVELOPER",
    sourceArn: identity.identityArn,
    from: "Example <no-reply@example.com>",
    replyToEmailAddress: "support@example.com",
  },
});

• Models the Cognito EmailConfiguration wire shape: emailSendingAccount ("COGNITO_DEFAULT" | "DEVELOPER"), sourceArn, from, replyToEmailAddress, configurationSet
• UpdateUserPool resets omitted fields to service defaults, so the reconciler echoes the observed EmailConfiguration back when the prop is undefined — an unrelated update (e.g. password policy) never clears an SES-backed configuration; drift compares normalized desired vs observed with the COGNITO_DEFAULT default filled in on both sides
• DEVELOPER without sourceArn fails early with the typed InvalidUserPoolConfiguration before any API call