Add Auth0 JWT authorizer to API Gateway (LEY-14)

[ltyu]

Summary

Adds Auth0 JWT verification to the HTTP API at the API Gateway layer, so all three OAuth routes require a valid JWT before any Lambda is invoked.

Changes

• Add Auth0IssuerParam and Auth0AudienceParam SAM parameters
• Define explicit GmailTranslatorHttpApi (AWS::Serverless::HttpApi) with Auth0JwtAuthorizer using native API Gateway JWT verification — no Lambda authorizer needed
• Apply the authorizer to all three routes via ApiId reference on each function event (/auth/google/start, /auth/google/callback, /auth/google/disconnect)
• Update Outputs to reference the explicit GmailTranslatorHttpApi instead of the previous implicit ServerlessHttpApi
• Add Auth0IssuerParam and Auth0AudienceParam placeholder values to samconfig.toml with inline comments explaining where to find the real values in the Auth0 dashboard

How it works

API Gateway natively verifies the JWT signature (using Auth0's JWKS endpoint), expiry, issuer, and audience before the Lambda is ever invoked. A request without a valid Authorization: Bearer <token> header receives a 401 immediately.

Testing

• sam validate --lint passes clean
• No Lambda code changes in this PR — auth enforcement is purely infrastructure

Notes

• Requires Auth0IssuerParam and Auth0AudienceParam to be set at deploy time (see samconfig.toml comments)
• Closes LEY-14