Amplify Gen 1 → Gen 2 Rebuild (rms-app backend)

# Why?

**As a** maintainer of rms-app's backend

**I want** to finish moving off Amplify Gen 1 (CLI-driven `amplify/backend/*` CloudFormation) onto Amplify Gen 2 (code-first `ampx`/CDK)

**So that** the backend is on a supported, code-first infra toolchain, and the paused schema epic (#244 and its subtasks) plus the new-frontend work can resume on solid ground.

# What?

Full context and phased plan: `.claude/plans/can-you-make-a-shimmying-crane.md`.

This isn't a straightforward migration — it's mostly a rebuild, because this project uses raw CloudFormation DynamoDB tables and a custom shared-source TypeScript build pipeline (`backend-build.js`) rather than Amplify's higher-level GraphQL "Data" or default `defineFunction` bundling. Storage (7 tables) and compute (10 Lambdas) have no automated migration path and must be hand-rebuilt as CDK code inside Gen 2's `defineBackend`.

Key facts baked into the plan:
- The Gen 1 Cognito User Pool was already deleted from `alpha` (no users to preserve) — auth is a fresh `defineAuth` pool, not a reference.
- `smsrouter`'s old SNS/Pinpoint phone number is lost — it deploys as a plain Lambda with no trigger; rebuilding SMS routing is separate future work, out of scope here.
- 6 of 7 DynamoDB tables share an identical shape (partition key `id`, streams enabled); `transactions` is the outlier (partition key `number`, no streams).
- Zero-data-loss table cutover for the live `alpha` environment relies on `cdk import` (brings existing tables under the new stack without delete/recreate).

## Status (as of 2026-07-30)

- **Phase 0 — Prep**: DONE. `amplify-gen2/` scaffolded, Gen 2 deps added.
- **Phase 1 — Auth (`defineAuth`)**: DONE. `amplify-gen2/auth/resource.ts` exists.
- **Phase 2 — Storage tables**: DONE. `amplify-gen2/storage/tables.ts` defines all 7 tables.
- **Phase 3 — AddItem POC**: DONE. `amplify-gen2/functions/add-item/resource.ts` exists and is wired into `backend.ts`.
- **Phase 4 — Remaining 9 Lambdas**: NOT STARTED. Only compiled `build/` output exists for `borrow-from-schedule`, `borrow-item`, `create-batch`, `create-reservation`, `delete-batch`, `delete-item`, `return-item`, `smsrouter`, `update-tags` — no `resource.ts` for any of them, and none are wired into `defineBackend` in `backend.ts`. Tracked as a sub-issue below.
- **Phase 5 — `alpha` cutover**: NOT STARTED. Tracked as a sub-issue below.
- **Phase 6 — Decommission Gen 1**: NOT STARTED. Tracked as a sub-issue below.

## Paused work, to resume after Phase 6

The backend schema epic (#244 and subtasks #245/#247/#248, plus #258/#52/#51/#213) and the new-frontend plan are paused pending this rebuild, since this migration deliberately keeps `ts-code/src` (business logic) untouched while the surrounding infra changes shape entirely. Resume that work on the rebuilt Gen 2 codebase once Phase 6 completes.

# Additional context

Sub-issues below cover the remaining phases. See the plan doc for full detail on CI/CD adaptation (`backend-ci.yml`/`backend-cd.yml`/`backend-canary.yml`) and test suite adaptation (`Amplify.test.ts` config source + auth rewrite), both folded into the Phase 5/6 sub-issues.