DC:255 Migrate IOptions<T> to IOptionsMonitor<T> for live AppConfig reload

[spokenbird]

• Migrate settings consumers from IOptions<T> (singleton-cached) to IOptionsMonitor<T> so AWS AppConfig changes are picked up without
  redeploying ECS tasks
• Change SocureSettings DI registration from singleton to transient factory via IOptionsMonitor, preserving clean layering (UseCases layer still injects plain SocureSettings)

Settings affected

• IdProofingRequirementsSettings — IAL requirements
• SocureSettings — stub/live toggle, URLs
• SmartySettings / AddressValidationPolicySettings — address validation
• StateHouseholdIdSettings — Email vs Phone household lookup

What's NOT changed (intentionally)

• JwtSettings — changing signing keys at runtime would invalidate active sessions
• SeedingSettings — seeds once at startup; fixed via env var instead
• IdentifierHasherSettings — security-sensitive, singleton is appropriate

Test plan

• All 680 backend tests pass locally
• Deploy to DC dev, verify "Seeded 21 mock household records" in logs
• Change an IdProofing requirement in AppConfig, wait 90s, verify it
  takes effect without redeployment