Identity aliases — dev harness
CRUD for the canonical-identity ↔ cognito/provider alias map (federation rewrite). One canonical person → N per-provider principal rows.
You need to sign in as an administrator.
Save alias (PUT — upsert)
{}Fetch by key (canonicalId + cognitoSub)
{}Resolve by cognitoSub (byCognitoSub GSI — the story-2 hot path)
{}List by email (byEmail GSI)
{}