Review Security Hub findings and fix top

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Security Hub 2026-11-03: FSBP+CIS READY both regions; 15 open control failures → 10. Fixed the 5 jaah-owned: console edge SecretsManager.1 (R-SOC-38) + CloudFront.4/.17 (R-SOC-65, rule 26), CloudFormation.4 ×2 via new apps service role (applied live, stacks associated), GuardDuty pair triaged; IAM.2 on hand-made jaah-apps user closed live (R-SOC-66). Remaining: 7 other-repo (R-SOC-62), SSM.1/.3 need hosting node reboot (R-SOC-63). PR #7838 queued to the merge lane; quick gate, terraform test, review lanes green. Memory: used mem-24381, mem-31190, mem-29247, mem-30564; proposed 1 recipe.