Review Security Hub findings and fix top

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Closed the top Security Hub controls: ECR.2 (immutable tags), CloudFront.6 (apps WAF), SecretsManager.1 (scoped suppression R-SOC-70), SSM.1/SSM.3 live host fixes; CloudFront.15 deferred to jaah-ai/sales (R-SOC-62). PR #8010 merged by the lane as 1277301a; Jaah Deploy succeeded. No UI surface affected. Memory: used mem-31190, mem-37224; proposed 1 gotcha (mem-38049).