minute: replace basic auth with magic-link + cookie

[chrisns]

Summary

• Replace the CloudFront Function basic-auth gate with a magic-link + HttpOnly cookie scheme. Users open MinuteLoginUrl (ends in ?key=<token>), CloudFront sets a 7-day cookie and 302s to the clean URL. Subsequent requests authenticate via the cookie, so fetch() works and no browser dialog is required.
• Some users on managed/corporate browsers could not see the basic-auth dialog at all, and Chromium increasingly strips URL-embedded credentials (https://user:pass@host), so the previous MinuteLoginUrl was also unusable for them.
• The 401 page deep-links back to the stack's CloudFormation Outputs tab so a user who lands on the bare URL can recover without help.
• Outputs reshaped: MinuteLoginUrl is now https://<domain>/?key=<token>, MinuteAuthToken added for support/diagnostics, BasicAuthUsername / BasicAuthPassword removed. Walkthrough (steps 1, 2, index, screenshot YAML) rewritten to the single-link flow.
• Also sets generateBootstrapVersionRule: false on the synthesizer. ISB pool accounts have no CDK bootstrap, and the missing flag was blocking out-of-band change-set creation on existing StackSet instances.

Live-deployed via change set to account 970659054265 to unblock the reporting user. Hub StackSet still ships the old template, so this PR is what makes the fix permanent across future deploys.

Closes issue #11 in the Minute scenario lessons (basic auth breaks fetch() and modern browsers).

Test plan

• npx tsc --noEmit passes
• npx cdk synth produces clean template; Fn::Sub correctly substitutes Token, StackName, StackOutputsUrl
• No stale BasicAuth* references anywhere in cloudformation/scenarios/minute/ or src/walkthroughs/minute/ or src/_data/
• Live smoke-tested on account 970659054265 after change-set apply:
  • Bare URL returns 401 with the new HTML deep-link page
  • ?key=<token> returns 302 with Set-Cookie: ndx-minute-auth=...; Max-Age=604800; Secure; HttpOnly; SameSite=Lax; Path=/
  • Cookie present returns 200 from origin
  • Wrong ?key= returns 401
• After merge: rebuild & republish minute blueprint via deploy-blueprints.yml so the hub StackSet ships the new template
• After merge: retake src/assets/images/walkthroughs/minute/screenshots/cloudformation-outputs-desktop.png against a fresh deploy showing the new output names