feat(infra): Delete encoder credentials on teardown

[renato-freis]

Summary

Teardown now deletes the encoder credentials it created, instead of asking the operator to remember a precondition.

The cleanup section told the reader to delete every channel from the dashboard before destroying the stacks, or Parameter Store secrets would be left in the account. That is exactly the kind of instruction a reader forgets, and the consequence is an orphaned credential.

Prerequisite: credentials were not namespaced per environment

Passwords were stored under a shared /pois/channels prefix, while the README states that several environments can coexist in one account and Region. A purge scoped to that prefix would have deleted another environment's secrets, so this had to be fixed first.

Credentials now live under /pois/<env>/channels, injected through CREDENTIAL_PATH_PREFIX, with the IAM grants scoped to it. Synth confirms the isolation:

Stack	Purge grant resolves to
pois-reference-server-dev-api	arn:aws:ssm:...:parameter/pois/dev/channels/*
pois-reference-server-prod-api	arn:aws:ssm:...:parameter/pois/prod/channels/*

The legacy prefix stays granted so that channels created by an earlier deployment keep working: reads and deletes use the parameter path recorded on the channel, not the current prefix. Existing deployments therefore keep functioning and drain naturally as channels are updated or deleted.

The custom resource

Added to the API stack. It is inert on create and update; the work happens on delete:

• paginates GetParametersByPath so more than one page is handled
• batches DeleteParameters within its ten-name limit
• logs failures with the parameter names instead of raising, because a cleanup error must never leave the stack in DELETE_FAILED, which is worse than a leftover parameter

Testing

The shipped handler was extracted from the construct and run against real Parameter Store with twelve credentials under one environment prefix and two under another:

Create -> {'PhysicalResourceId': ...}                  parameters untouched (12)
Update -> {'PhysicalResourceId': ...}                  parameters untouched (12)
Delete -> {'Deleted': 12, 'Failed': 0}
   this environment: 12 -> 0
   other environment: 2 -> 2   (untouched)

The twelve spanned two pages of GetParametersByPath, which exercises the pagination, and two batches of DeleteParameters, which exercises the batching. Test parameters were removed afterwards.

Also: infrastructure lint, build and cdk synth for dev and prod; backend at 196 passing with coverage 72.90%, including new cases for prefix resolution from the environment variable, explicit override, trailing slash, environment isolation, and reading a credential written under an earlier prefix.

Documentation

The cleanup section loses the manual step. What remains is the honest residue: log groups that expire on their own, and a note for anyone who deployed before this change that their credentials sit under the old shared prefix and are not covered by the purge.