Give the ECS task role project-scoped S3 and Cognito access

### Dependency

- [ ] hackforla/incubator#194 — the `project` tag standard, including the S3 ABAC opt-in and the choice between `aws:ResourceTag` and `s3:BucketTag`

### Overview

We need a project's container to reach its own S3 buckets and its own Cognito user pool and no others, so that application data access is granted by tag rather than by naming each resource in a policy. S3 and Cognito are the task role's project-scoped grants.

### Action Items

- [ ] Confirm this goes on the **task role** (`aws_iam_role.instance`), not the execution role. The task role is the identity application code runs as; the execution role only pulls images, writes logs and reads startup secrets.
- [ ] Tag the project's S3 buckets with `project`, per the tag standard.
- [ ] **Enable ABAC on each of those buckets** — `aws s3api put-bucket-abac --bucket --abac-status Status=Enabled`. Until this is done, tag conditions are **not evaluated at all** for that bucket and the policy will appear to do nothing. All five buckets in the account report `Status: Disabled` as of 2026-09-01.
- [ ] **Before enabling it, confirm Terraform can still manage those buckets' tags.** Enabling ABAC retires `PutBucketTagging` in favour of `TagResource`/`UntagResource`. Test on a throwaway bucket, not on a project's.
- [ ] Add an S3 statement to the task role policy in `terraform/modules/container/main.tf` granting `s3:ListBucket` on the bucket and `s3:GetObject`, `s3:PutObject` and `s3:DeleteObject` on `/*`, conditioned on the bucket's `project` tag.
- [ ] Tag the Cognito user pools with `project`. None of the three is tagged today. Cognito supports constraining IAM permissions by user pool tag and needs no per-resource opt-in, unlike S3.
- [ ] Establish which Cognito actions each application actually calls before granting anything. `cognito-idp` has a large action surface and the task role should receive the operations the application uses, not a blanket grant.
- [ ] **Take care with `us-west-2_VH24AGQ3p`** — it is the live Home Unite Us production pool with 96 real users, adopted into Terraform by hackforla/incubator#186. Tagging it is safe; changing what may call it is not, and must be verified against a working sign-in.
- [ ] After the PR merges, **negatively test both**: confirm a container from one project cannot list or read a different project's bucket, and cannot call a different project's user pool.

### Resources/Instructions

- **Do not copy AWS's published example 1.2 verbatim.** As written it is an `Effect: Deny` with `StringEquals` on the matching tag, which denies access when the tags *match* — the opposite of the intent. Write it as an `Allow` with `StringEquals`, or a `Deny` with `StringNotEquals`.
- [Using tags with S3 general purpose buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/buckets-tagging.html) and [Enabling ABAC in general purpose buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/buckets-tagging-enable-abac.html).
- [Tagging Amazon Cognito resources](https://docs.aws.amazon.com/cognito/latest/developerguide/tagging.html).
- Cognito user pools as of 2026-09-01: `us-west-2_Fn4rkZpuB` (vrms-dev), `us-west-2_VH24AGQ3p` (Home Unite Us, production, 96 users), `us-west-2_rWxdMKVzy` (home-unite-us).
- There are no per-project S3 buckets in the account yet — the five that exist are two CloudTrail log buckets, two Terraform state buckets and the `civictechindex.org` website bucket. The S3 half may need a bucket to exist first; the Cognito half does not and can proceed independently. Consider splitting on that line if this issue proves too large.

Start with hackforla/incubator#194 and inspect terraform/modules/container/main.tf to confirm the task-role policy and project tag standard. Test S3 ABAC and tag management on a throwaway bucket with the documented AWS CLI command, then establish the Cognito actions used by each application. Done means project tags and scoped grants are verified, production sign-in remains working, and cross-project S3 and Cognito access is negatively tested.

Written by the indexing model from the issue text.