feat(aws): emulate SNS mobile push applications and endpoints

[kamal]

Review and landing order

• Rebased onto main on 2026-10-03 (after KMS/STS, 0.14.0). Only docs conflicted; the README, AWS docs page and AWS skill now list SNS alongside KMS.
• Needed by hotel2 worlds: envoy-web registers mobile devices with SNS and envoy/notifications (envoy/notifications#772) publishes pushes. Worlds point both at this emulator so no push call leaves the world.

Summary

Applications using SNS mobile endpoints previously had no local push API. This adds platform application and endpoint management, plus Publish capture for APNS, APNS_SANDBOX, and GCM payloads without contacting device providers.

• Support registration, attribute updates, disabling, deletion, and paginated listing with region/application isolation.
• Capture the original message and selected platform payload; inspect by message ID or target ARN through HTTP read-back and the AWS inspector.
• Preserve S3 root routing and include SNS state in snapshots and resets.
• Document SDK setup, API coverage, inspection, and limitations in the README, AWS guide, docs site, and CLI help.

Validation

• 67 AWS tests passed, including 11 new SNS SDK/wire tests and all existing AWS tests.
• Coverage includes lifecycle/read-back, all three payload platforms, conflicting registrations, disabled/missing endpoints, malformed payloads, UTF-8 limits, pagination, isolation, snapshots/reset, and inspector escaping.
• Core and AWS builds, AWS typecheck/lint, formatting, and whitespace checks passed.
• Edited AWS MDX page compiled successfully.
• Separate real SDK test against the built package passed: application/endpoint creation, structured Publish through /sns/, and HTTP capture read-back.

Limitations

Direct APNs HTTP/2 and direct FCM APIs are not implemented. This change emulates SNS acceptance and local capture, with no real delivery, provider feedback, retries, credential validation, or throttling. Topics/subscriptions, SMS, Subject, and MessageAttributes are unsupported. Provider payload validation is limited to JSON object shape. Full CLI and full docs-site builds were not run.