feat(bootstrap): resource-action-map for synth-time validation

## Parent

Sub-issue 4 of #120 (RFC: Least-privilege CDK bootstrap policies as code)

## Branch strategy

`feat/bootstrap-action-map` → targets `feat/bootstrap-template`

## Estimated review time: ~25 min

## Summary

Create a mapping from CloudFormation resource types to the IAM actions required to manage them (CRUD lifecycle), scoped to the ~30 resource types used by this app. This map powers the synth-time Aspect (Sub-issue 5) and informs the preflight validator (Sub-issue 6).

## Deliverables

- [ ] Create `cdk/src/bootstrap/preflight/resource-action-map.ts`:
- Export a typed map: `Record`
- Cover all CF resource types present in `cdk.out/` after synth (e.g., `AWS::DynamoDB::Table`, `AWS::Lambda::Function`, `AWS::ApiGateway::RestApi`, `AWS::EC2::VPC`, `AWS::Cognito::UserPool`, `AWS::WAFv2::WebACL`, `AWS::Bedrock::Guardrail`, etc.)
- Each entry's action list is the minimum CloudFormation needs to manage the resource lifecycle
- [ ] Create `cdk/src/bootstrap/preflight/index.ts` — barrel export
- [ ] Create `cdk/test/bootstrap/resource-action-map.test.ts`:
- All resource types in the synthesized template have a mapping entry (synth → extract types → assert coverage)
- Each action list is non-empty
- All actions use valid IAM action format (`service:ActionName`)
- Combined action set is a subset of the three policy documents' action sets (the map doesn't require more than what policies allow)

## Key design decisions

- **Scoped to this app's resources** — not all 800+ AWS CF resource types. Keeps maintenance tractable.
- Actions derived from [CloudFormation resource type documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html) and validated against CloudTrail from prior deployments.
- Unknown resource types (not in map) produce a **warning**, not an error — allows new constructs to be added without immediately updating the map.
- Map is a plain TypeScript object (not loaded from JSON) — benefits from IDE autocomplete and type checking.

## Acceptance criteria

- `mise //cdk:synth` followed by resource-type extraction shows 100% map coverage of current template
- All tests pass
- No circular imports between `preflight/` and `policies/`