fix: route /api/agent/* through ALB to fix agent timeout and access block

[YounBrand]

Problem

Agent calls (POST /api/agent/budget) were failing with "Failed to initialize budget" due to two compounding issues:

1. Lambda Function URLs blocked at account level — Despite AuthType=NONE and a correct resource-based policy, the Lambda Function URL returns AccessDeniedException (403), likely due to an org SCP. CloudFront received the 403,
   applied the custom 403→200 error response (SPA fallback), and served index.html. The browser got HTML instead of JSON, res.json() threw a SyntaxError (not ApiError), causing the misleading "Failed to initialize budget" error
   message.

2. Lambda timeout too short — Even if routing worked, the previous 29s timeout would kill Claude agent calls that take 39s+.

Solution

• Route /api/agent/* CloudFront behavior → agents-alb origin (previously pointed to lambda-function-url)
• The ALB already has a listener rule (priority 10) routing /api/agent/* to a Lambda target group
• @fastify/aws-lambda v6 handles ALB v1 event format natively — no code changes needed
• ALB has no request timeout limit; Lambda max is 15 minutes
• Increase Lambda timeout: 29s → 300s
• Add Terraform resources for the ALB Lambda target group, attachment, listener rule, and Lambda permission (matching live AWS state)