test(cognito-users): cover directory guards and pagination failures

[ivancasco]

Closes #172.

Adds missing Cognito directory unit coverage for OPTIONS, unsupported methods, missing identity and pool configuration, attribute projection/defaults, empty results, exact pagination tokens, and SDK failures on both the first and later pages. Tests also isolate SSO configuration and restore logging spies.

The current branch already uses ESM, centralized workspace test dependencies, and esbuild-only Lambda packaging, so this change preserves those conventions and existing admin/SSO behavior.

Validation (isolated PR worktree, commit 5aa1149):

• Full backend suite: 2,825 tests passed on both Node 22.22.3 and Node 24.18.0, including the 37 Cognito tests, with Docker-backed global setup.
• Frontend suite: 540 tests passed on each runtime.
• Release tooling: 49 tests passed on each runtime.
• Root/frontend lint and formatting checks, secretlint, AWS SDK alignment, Terraform formatting, frontend type-check/build, and Cognito bundle build passed.
• TFLint 0.64.0 with the repository-pinned AWS ruleset 0.47.0: passed.
• Semgrep 1.176.0 with p/javascript and p/typescript: no findings across 578 files. The broad scan reported partial parsing in seven existing frontend files and default exclusions; an explicit scan of the changed Cognito test file had no findings or parsing errors.
• Fable 5.1 reviewed the patch: no actionable findings.

Validation caveats:

• Root production dependency audit reports 2 high and 2 moderate vulnerabilities in unchanged dependencies (brace-expansion, js-yaml, hono, and qs). Frontend production audit reports no vulnerabilities. Dependency remediation is outside this test-only patch.