#7116 fix(cloudwatch): resolve selector credentials server-side

Stacked on #7095. Review the diff against the PR1 branch. Do not merge until #7095 lands and this PR is rebased and retargeted to staging.

Summary

• Add dedicated CloudWatch Log Group and Log Stream selector routes using PR1's authorized server-side context resolver.
• Extract reusable AWS listing functions while preserving runtime-route response metadata and behavior.
• Accept literals or exact references on the wire, validate resolved AWS values, and return strict name-only selector responses.
• Keep CloudWatch routes, contracts, provider-local registry map, selector wiring, and tests isolated in this PR.

Security behavior

• Successful personal/workspace environment mutations invalidate mounted selector, canvas-label, and workflow-search caches through PR1, so an unchanged {{KEY}} refetches without exposing its value.
• AWS access key, secret key, region, and selector dependencies remain literals or opaque references in the browser.
• Resolved values exist only in server code after workflow authorization.
• Inaccessible references short-circuit before AWS client construction.
• Selector responses expose names only; runtime routes retain their existing metadata contract.
• Query keys contain opaque dependency revisions rather than credential plaintext.

Focused coverage

• Wire/resolved validation separation and strict name-only responses.
• Both selector routes, pagination utilities, client destruction, and runtime-route compatibility.
• Literal/reference inputs, inaccessible-reference short-circuiting, and option mapping.
• Raw client transport and concise base-key privacy.

Verification

• Provider-focused Vitest: 4 files, 14 tests passed.
• App type-check passed.
• Root lint/format, strict API validation, client-boundary, React Query, and git diff --check passed on the combined stack.
• Combined full repository tests passed: 19/19 tasks; app 2,365 files passed, 3 skipped; 34,824 tests passed, 46 skipped.
• Combined focused selector suite: 28 files, 153 tests passed.
• All ten pairwise child diff intersections are empty; this child extends only the CloudWatch-owned selector contract map.

Browser verification

• After the freshness restack, a combined Jira smoke confirmed exact raw references still reach dedicated selector routes and provider/authorization failures stay sanitized. The exact mounted same-reference mutation is covered by PR1's real QueryClient regression because this local account cannot edit Secrets through the UI.
• A disposable CloudWatch workflow selector preserved literal, personal-reference, and shared-reference AWS inputs across the browser boundary.
• Deterministic invalid literals reached the dedicated selector route; personal/shared references returned sanitized unresolved-configuration failures.
• Responses and server logs exposed neither credential plaintext nor unnecessary runtime metadata.
• The disposable workflow was deleted afterward.