Reduce Lambda secret and IAM access

[ltyu]

Summary

• load only the specific SSM secrets each handler needs instead of always fetching the full app secret set
• remove unused environment variables from the Lambda functions to cut down exposed configuration
• replace broad DynamoDB, SSM, and KMS permissions with per-function least-privilege statements

Testing

• pnpm test:run -- src/services/parameterStore.test.ts src/handlers/startGoogleOAuth.test.ts src/handlers/googleOAuthCallback.test.ts
• pnpm exec tsc --noEmit
• sam validate