AgentCore runtime execution role missing appsync:GraphQL grant — AG-UI events can't publish to AppSync

### Problem

\`agent/handler/agent.py\` publishes AG-UI events to the GraphQL API by SigV4-signing a request against the \`appsync\` service using the runtime execution role's own credentials (\`agent.py:78-88\`), calling the \`publishAgentEvent\` mutation.

However, \`web/amplify/backend.ts\` never grants \`agUiHandlerRuntime.executionRole\` an \`appsync:GraphQL\` IAM permission on that mutation. The only IAM grants added to that role are \`bedrock:InvokeModel\`/\`InvokeModelWithResponseStream\` and \`bedrock-agentcore:ListEvents\` (\`backend.ts:321-334\`) — there's no \`appsync:GraphQL\` statement anywhere.

\`docs/ag-ui-handler-pattern.md:126\` documents this exact requirement ("AgentCore runtime execution role — \`appsync:GraphQL\` on \`publishAgentEvent\` — Container publishes AG-UI events"), noting it used to be wired by the now-removed \`extract-deployment-info.js\` post-deploy script. That step was never migrated into the in-stack CDK when the deploy path moved into \`backend.ts\` (PR #30) — so as it stands, the container's \`publish_event()\` calls fail with an AppSync authorization error.

### Impact

The \`/chat-handler\` page subscribes to \`onAgentEvent\` via AppSync (Cognito User Pool auth) expecting the AgentCore runtime to publish events into that channel. Without the missing IAM grant, the runtime cannot publish, so this flow is currently broken.

### Suggested fix

Add an \`appsync:GraphQL\` IAM policy statement to \`agUiHandlerRuntime.executionRole\`, scoped to the \`publishAgentEvent\` mutation on the AppSync API's ARN, inside \`web/amplify/backend.ts\`.

This is being tracked separately from #142/PR #30 per waltmayf's request to file issues for bugs found during that PR.

---
*Imported from `waltmayf/agentcore-amplify-fullstack`#54 — originally filed by @app/github-actions on 2026-07-06. Migrated to open-source repo; cross-references updated post-import.*

Start in web/amplify/backend.ts:321-334 and compare the execution-role grants with the AppSync call in agent/handler/agent.py:78-88. Read docs/ag-ui-handler-pattern.md:126 for the intended permission and inspect the publishAgentEvent mutation ARN. Done means the runtime role can publish that mutation and the /chat-handler flow no longer fails with an AppSync authorization error.

Written by the indexing model from the issue text.