Add CI that tests the step-up authentication flow

[HarshCasper]

The repo had no CI and no test.

New test.sh (make test) walks the step-up flow through the deployed API:

• creates a Cognito user and signs in with USER_PASSWORD_AUTH
• GET /info returns 401 without a token, 403 with a malformed token, and 200 with the access token
• with a STEP_UP_REQUIRED rule for /transfer in step-up-auth-setting, POST /transfer returns 401 and the authorizer records a STEP_UP_REQUIRED session in step-up-auth-session
• /initiate-auth returns MAYBE_SOFTWARE_TOKEN_STEP_UP for a user without MFA
• after associating a software token, /respond-to-challenge rejects a malformed code and accepts a generated TOTP code
• the session is STEP_UP_COMPLETED and POST /transfer returns 200
• the rule and the user are removed on exit

Sample fixes:

• Lambdas move from the deprecated nodejs18.x to nodejs22.x.
• The request authorizer now has AuthorizerResultTtlInSeconds: 0, set on the L1 resource because resultsCacheTtl expects a Duration from a different @aws-cdk/core copy and the stack failed to compile. The decision depends on the step-up session, which changes between requests with the same token, and the returned policy only covers the called method. With the default 5 minute cache, the step-up result could not take effect and calls to other methods reused the wrong policy.
• The challenge responder now awaits the session update before returning, so the Lambda cannot finish before the session is marked completed.
• The build scripts ran as #!/bin/sh but use [ "$1" == ... ], which dash rejects. On Linux the compressed module step was silently skipped and make build failed. They now use #!/bin/bash.
• make install also installs the CDK CLI and yarn, which make deploy needs. New make test target, and the README documents it.

New workflow: Node 22, make install, make build, make start, make deploy, make test, and LocalStack logs on failure.

https://claude.ai/code/session_01DZfDmzUBPqNAu3yFKyfCNM