Troubleshooting ALB docs expect CreateLoadBalancer AccessDenied, but current policy fails on AddTags

### What happened?

In the ALB troubleshooting module, the docs currently show the IAM failure after fixing subnet tags as missing `elasticloadbalancing:CreateLoadBalancer`:

- `website/docs/troubleshooting/alb/alb_fix_1.md`
- `website/docs/troubleshooting/alb/alb_fix_5.md`

In a fresh/current workshop run, the observed error is instead missing `elasticloadbalancing:AddTags` during `CreateLoadBalancer`:

```text
Warning FailedDeployModel ingress Failed deploy model due to AccessDenied: User: arn:aws:sts:::assumed-role/alb-controller-/ is not authorized to perform: elasticloadbalancing:AddTags on resource: arn:aws:elasticloadbalancing:us-west-2::loadbalancer/app/k8s-ui-ui-5ddc3ba496/* because no identity-based policy allows the elasticloadbalancing:AddTags action
```

This appears to come from the intentionally broken policy at `manifests/modules/troubleshooting/alb/.workshop/terraform/template/other_issue.json`. That policy already allows `elasticloadbalancing:CreateLoadBalancer`, but it lacks the create-time tagging permission for ALB/NLB creation:

```json
{
"Action": "elasticloadbalancing:AddTags",
"Condition": {
"Null": {
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
},
"StringEquals": {
"elasticloadbalancing:CreateAction": [
"CreateTargetGroup",
"CreateLoadBalancer"
]
}
}
}
```

So the controller passes the `CreateLoadBalancer` authorization check, then ELB rejects the create-time tags with an `AddTags` authorization error.

### Expected behavior

Either:

1. Update the ALB troubleshooting text/examples to show the current `elasticloadbalancing:AddTags` failure and explain that it is the dependent create-time tagging permission for `CreateLoadBalancer`; or
2. Change the intentionally broken policy so it actually lacks `elasticloadbalancing:CreateLoadBalancer`, matching the current tutorial narrative.

### Reproduction notes

On 2026-07-13, after following https://www.eksworkshop.com/docs/troubleshooting/alb/alb_fix_1 and fixing the subnet tags/restarting the controller, the ingress event and CloudTrail `CreateLoadBalancer` events both reported AccessDenied for `elasticloadbalancing:AddTags`, not `elasticloadbalancing:CreateLoadBalancer`.

Attaching the pre-created fixed policy and detaching `eksworkshopissue` resolved the problem; the ALB then appeared in `provisioning` state.

### Related

A prior older issue mentions missing `AddTags` in a different workshop path: #564. This issue is specifically about the current ALB troubleshooting module documentation/source mismatch.

Read website/docs/troubleshooting/alb/alb_fix_1.md and alb_fix_5.md alongside manifests/modules/troubleshooting/alb/.workshop/terraform/template/other_issue.json. Compare the documented failure with the policy's CreateLoadBalancer and AddTags permissions, then choose and validate one consistent direction: update the troubleshooting text or adjust the intentionally broken policy.

Written by the indexing model from the issue text.