Review and Fix Top Security Hub Findings

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Fixed the top Security Hub gaps: deleted the apps account's 17 default VPCs (closes EC2.6/10/55-60), turned VPC Block Public Access on there (EC2.172) and added apps.jaah.ai DNS query logging (Route53.2) via terraform (applied, 5 adds), resolved a stale IAM.18. SSM.3 on hosting pool-c-host diagnosed, needs the host. Remaining failures are yumapos-boss/sales resources (CloudFront.15 on prod jaah.ai needs TLSv1.2_2025). Quick gate and org terraform test green; PR #7490 queued to the merge lane. Filed draft Task 11848 (apps CI role can undo the guardrails). Memory: none applied; proposed 1 gotcha.