[Feature]: Add unit tests for lambda/cognito-users

### Description

Add unit tests for `lambda/cognito-users/index.js`, following the test setup established in #40 and extended through #62 / #65.

### Use case

Small handler (~65 LOC) that lists Cognito users for the project. Branching worth pinning down:

- `OPTIONS` short-circuits with `200 {}`.
- Non-`GET` methods return `405 Method not allowed`.
- Missing `requestContext.authorizer.claims.sub` returns `401 Unauthorized`.
- Missing `COGNITO_USER_POOL_ID` env var returns `500 User pool not configured`.
- Happy path: paginates `ListUsersCommand` while `PaginationToken` is set, flattens each user's `Attributes` into a map, and projects to `{ userId, email, displayName, enabled, status }` (with `email`/`displayName` defaulting to `''`).
- `ListUsersCommand` errors are caught and return `500 Internal server error`.

### Area

Backend (Lambda)

### Additional context

Reuse the conventions from #40 / #65:

- Vitest as the test runner.
- Per-lambda `package.json` with test devDependencies scoped to the lambda.
- Test layout: `lambda/cognito-users/test/*.test.js`.
- Terraform packaging via `npm ci --omit=dev --ignore-scripts` so dev deps never ship.
- Handler should be migrated to ESM as part of this PR (continuing the #41 rollout — most recent application is #65 for `ws-connection`).
- The new `lambda/cognito-users/package.json` should also include `lint` (oxlint) and `format` / `format:check` (oxfmt) scripts mirroring the other lambda workspaces (#37, #38), and the workspace should be added to the root `package.json` `workspaces` array.
- Mock `@aws-sdk/client-cognito-identity-provider` (`CognitoIdentityProviderClient.send` returning canned `ListUsersCommand` results, including a multi-page response to exercise the pagination loop).

Mocking strategy and exact coverage to be finalised during implementation planning.

Start with lambda/cognito-users/index.js and compare the test setup in the changes referenced by #40, #62, and #65. Add lambda/cognito-users/test/*.test.js and the per-lambda package.json, then update the root package.json workspace list; done means the listed response branches and pagination are covered, the handler is ESM, and lint, formatting, and Vitest commands pass.

Written by the indexing model from the issue text.