Force Google account picker on sign-in via Cognito managed login + prompt=select_account

# Why?

**As a** user who has multiple Google accounts (or just signed out and wants to switch accounts)
**I want** clicking "Sign in with Google" after signing out to show Google's account picker again
**So that** I'm not silently re-authenticated as whichever Google account I used last time.

# What?

Currently, after signing out of the app (`web/components/SignOutButton.tsx`) and clicking "Sign in with Google" again, Google silently re-authenticates as the same account with no picker shown — because our Cognito sign-out only ends the app's Cognito session, not Google's own separate browser session, and Cognito's OAuth flow doesn't currently force re-selection.

# Investigation so far (no code changed yet)

- Amplify's `signOut()` already redirects through Cognito's `/logout` endpoint when an OAuth config is present (confirmed by reading `@aws-amplify/auth`'s `handleOAuthSignOut`/`oAuthSignOutRedirect` source) — this is correct and working. The gap is that Cognito's logout doesn't forward to Google's own logout, and more importantly, our sign-*in* request doesn't ask Google to show the picker at all.
- The standard fix is Cognito's `prompt=select_account` OAuth parameter on the `/oauth2/authorize` request, which Cognito forwards to the upstream IdP (Google) when `identity_provider=Google` is present in the request.
- **Constraint**: per [AWS's own docs](https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html), `prompt` is "available in the managed login branding version only, not in the classic hosted UI." Confirmed via `aws cognito-idp describe-managed-login-branding-by-client` that this user pool client (`amplify/auth/resource.ts`) currently has **no managed login branding configured** — it's on the classic Hosted UI.
- Amplify's `signInWithRedirect()` client API (used in `web/app/login/page.tsx`) has no option to pass a `prompt` parameter through at all, regardless of Hosted UI mode.

# How? (decided direction, not yet scoped in detail)

Enable Cognito's managed login branding for this user pool client, then use `prompt=select_account` (likely via a manually-constructed `/oauth2/authorize` URL on the login button, since Amplify's SDK doesn't expose `prompt`). This is a real infrastructure/config change with its own visual redesign implications (managed login has a different look from the classic Hosted UI redirect), so needs its own design/plan-mode pass — not a one-line fix.

**Deliberately deferred** (backlog, not urgent) — the user wants to focus on other UI work first.