CI follow-up: fix bare AWS service names in docs + lazy-init Lambda boto3 clients

Follow-up debt surfaced when CI was unblocked in #7 (the workflow had never actually run before due to an invalid empty `env:`).

## 1. Lambda boto3 clients created at import time
`cdk/lambda/pre-signup/index.py` and `post-confirmation/index.py` call `boto3.client(...)` at **module scope**, which raises `NoRegionError` when imported without a region. #7 worked around this by setting `AWS_DEFAULT_REGION`/`AWS_REGION` on the pytest step (mirrors the Lambda runtime). The cleaner fix is to lazy-init the clients inside the handler (or a cached accessor) so import has no side effects.
- [ ] pre-signup: move `cognito_client` to lazy init
- [ ] post-confirmation: move `eks/sns/sts/sm/cognito` clients to lazy init
- [ ] cost-enforcer already uses `region_name=REGION` (lower priority)

## 2. Bare AWS service names in prose (Rubric findings)
`scripts/check-rubric.sh` flags 17 prose lines using bare service names. #7 set the Rubric step to **report-only** (consistent with cdk-nag/Semgrep/Trivy, which are already non-blocking for sample code). Fix the names, then optionally restore Rubric to blocking.
- [ ] docs/development/quick-start.md (6)
- [ ] docs/performance-optimization.md (4)
- [ ] README.md (3)
- [ ] docs/missing-documentation.md (2)
- [ ] docs/comprehensive-optimization-plan.md (1)
- [ ] docs/api/README.md (1) ("AWS Bedrock" -> "Amazon Bedrock")

## 3. Optional: tighten CI gates
Decide which advisory scans (cdk-nag, Semgrep, Trivy, npm-audit, Rubric) should become blocking for a published sample.

Start with cdk/lambda/pre-signup/index.py and post-confirmation/index.py, then run the pytest step without the region workaround to verify imports. Review the six listed documentation files and scripts/check-rubric.sh for the reported bare service names. Done means both Lambda modules import without a region, the documented names are corrected, and any CI gate decision is recorded.

Written by the indexing model from the issue text.