Scope down S3 IAM permissions to least-privilege (#371)

[nickclyde]

Summary

Closes #371

Replaces AmazonS3FullAccess with per-Lambda IAM roles scoped to the exact S3 prefixes each function needs:

• TTC Lambda (ttc_lambda_role): s3:GetObject/s3:HeadObject on eCRMessageV2/ and ValidationResponseV2/; s3:PutObject on TTCAugmentationMetadataV2/ and TTCMetadataV2/; plus OpenSearch access
• Index Lambda (index_lambda_role): OpenSearch access only — no S3 permissions (it doesn't use S3)
• Augmentation Lambda (augmentation_lambda_role): s3:PutObject on AugmentationEICRV2/ and AugmentationMetadataV2/ only — no OpenSearch access

Uses moved blocks for the TTC role rename so existing deployments won't see a destroy/recreate cycle.

Changes

• terraform/main.tf — Split shared lambda_role into 3 separate roles with scoped inline S3 policies; updated Lambda function role refs and OpenSearch domain access policy
• terraform/_outputs.tf — Replaced single lambda_role_arn output with per-Lambda outputs
• terraform/README.md — Updated IAM docs, removed S3 scoping TODO

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.79%. Comparing base (adc944a) to head (4a242a2).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #425   +/-   ##
=======================================
  Coverage   95.78%   95.79%           
=======================================
  Files          42       42           
  Lines        2183     2186    +3     
=======================================
+ Hits         2091     2094    +3     
  Misses         92       92           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[robertandremitchell]

lgtm

[BradySkylight]

Good catch!