fix: unblock fresh deploys (AWS CDK CLI pin + auth-ui asset upload)

[snese]

What

Two independent fixes that currently block every fresh cdk deploy of this
sample, cherry-picked out of #9 so main is deployable without waiting for the
gVisor feature review. Part of #5 hygiene.

• fix(deps): bump the AWS CDK CLI to ^2.1128.1. A dependabot bump took
  aws-cdk-lib to 2.260.0 (cloud-assembly schema 54), which the pinned CLI
  2.1114.1 cannot read — cdk synth/deploy fail on a clean checkout.
• fix(auth-ui): exclude node_modules/tests from the AuthUi
  BucketDeployment. The asset upload was ~110 MB / 10,790 files and timed out
  the AWS Lambda function backing the deployment, blocking CREATE_COMPLETE
  for all fresh deploys. Now ~52 KB / 7 files.

Verification

Both fixes were verified as part of the fresh full-stack cdk deploy
documented in #9 (stack reached CREATE_COMPLETE on a net-new deployment in
us-east-1). CI covers synth on every PR.

Notes

#9 is rebased on top of these commits.