Send user-bot DMs through Slack using the token in SSM

[ale210]

Part of #212 (PR 2 of 2: the Lambda change; the SSM parameter went in with #213)

What changes did you make?

• New src/slack-token.ts: reads the bot token from /user-bot/slack-bot-token (named by SLACK_TOKEN_PARAMETER) with decryption, caches it per execution environment, and does not cache a failure. Anything not starting xoxb-, including Terraform's placeholder, is an error
• handler.ts: the sender is now resolved with getSender() after the tag checks and before UpdateLoginProfile, so a missing or bad token leaves the user's password unchanged
• index.ts: deployed handler now uses SlackMessageSender; StubMessageSender stays for local runs and tests only
• Tests: token loader, the get-sender → reset → send ordering, no token read for skipped users, and a test of the deployed wiring in index.ts with SSM, IAM and Slack mocked. 51 tests
• README: where the token lives, how to set or rotate it, and the refuse-before-reset behaviour

Why did you make the changes (we will use this info to test)?

• So the user-bot sends real Slack DMs (see Wire the user-bot Lambda to Slack: bot token in SSM, real DMs, end-to-end test #212)
• Test user-bot Lambda should pass on this PR
• After merge, Deploy user-bot Lambda should run green. Until the token is set, a new user is refused with a logged SlackTokenError and their password is unchanged