Cognito via Amplify from day one

The mobile app's first commit already had AWS Amplify with Cognito for sign-in, with the CloudFormation generated by the Amplify CLI committed next to the Dart code.

Managed auth from the first day meant never writing a password store, and it meant learning to read generated CloudFormation early. Both paid off: Cognito stayed the sign-in for every later generation of the app, mobile and web, and reading generated stacks is most of what CDK work is.