feat: delegate application S3 resources

[glitchedmob]

Establishes a reusable control-plane/data-plane boundary for application-owned S3 storage managed by infra-app-config.

• Allows infra-app-config to create and configure arbitrary S3 buckets without object-data access.
• Protects the shared Terraform state bucket from application bucket management and workload access.
• Allows infra-app-config to create arbitrarily named, repository-owned IAM roles without assuming or passing them.
• Requires every application role to use a boundary limited to approved S3 operations from SGF Devs K3s service-account identities.
• Lets each application role policy select its own bucket without future infra-aws-core changes.