fix(infra): IAM least privilege, collision-safe alert IDs, acknowledged string constants

[bsatrom]

Summary

• Remove aws-marketplace:Subscribe from chat query Lambda IAM role — this permission allows subscribing to paid Marketplace products and should never be in a Lambda execution role; also scope bedrock:InvokeModel to specific model ARNs
• Replace Math.random() alert ID generation with crypto.randomUUID() — eliminates collision risk at high throughput, uses built-in Node 20 crypto module
• Add ACKNOWLEDGED constant ('true'/'false' strings) to shared module — prevents accidental boolean writes that would break the GSI query
• Add marshallOptions: { removeUndefinedValues: true } to DynamoDB clients in api-alerts and api-devices — matches the pattern already used in api-ingest and prevents latent runtime errors on optional fields

Test plan

• CDK synth completes without errors (cd songbird-infrastructure && npx cdk synth)
• Alert creation in ingest produces UUIDs in the alert ID field
• Acknowledged/unacknowledged alert queries return correct results
• Chat query Lambda still successfully invokes Bedrock models

🤖 Generated with Claude Code