feat(profiles): generalize per-resource auth overrides (#178)

[rafaself]

Summary

• Add optional auth?: ProfileAuthConfig to all application profile resource blocks (ecs, rds, ssm, ecr, s3, ses, sns, eventbridge, budget) with shared validation rules.
• Wire application-ops section builders to resolve credentials per resource block (resource auth -> profile auth -> default).
• Add resolveSectionCredentials helper and update docs/examples for cross-account SNS and resolution order.

Closes #178

Test plan

• pnpm run typecheck
• pnpm test
• pnpm run test:integrity
• Validation tests for SNS/ECS resource auth, invalid user ARN, externalId acceptance
• Access tests for resolveSectionCredentials and block override precedence
• Application-ops section tests for per-block credential resolution and SES behavior preservation

Made with Cursor