Merge develop into main: HITL metadata guard fix + AWS Backup plan coverage for Amplify DynamoDB

[dereknorrbom]

Summary

This PR merges develop into main and includes two functional infrastructure/application updates:

1. Dashboard HITL metadata guard fix (procedure-hitl)
2. AWS Backup plan coverage for Amplify Gen2 DynamoDB tables

Included Changes

1) Dashboard HITL fix

• dashboard/lib/procedure-hitl.ts
  • Tightened parseMessageMetadata object guards to avoid null-impossible comparisons while preserving behavior.

2) AWS Backup governance for Amplify tables

• dashboard/amplify/backend.ts
  • Added DynamoDbBackupStack
  • Added AWS Backup vault and plan for environment-scoped naming
  • Added daily backup rule (05:00 UTC) with 35-day retention
  • Added backup selection over all Amplify Data DynamoDB tables via BackupResource.fromDynamoDbTable(...)
  • Kept PITR enablement in place (PITR + Backup Plan are complementary controls)

Why

• Resolves remaining dashboard Code Quality warning from the HITL metadata guard path.
• Remediates Prowler backup-governance findings that require DynamoDB tables to be assigned to an AWS Backup plan (separate from PITR).

Validation

• npx jest lib/__tests__/procedure-hitl.test.ts --runInBand (dashboard)
  • Result: passed
• npx tsc -p amplify/tsconfig.json --noEmit --pretty false (dashboard)
  • Result: passed
• Staging verification completed for AWS Backup:
  • Backup plan and table selection present
  • Manual on-demand backup job executed successfully

Notes

• This PR also includes project-management synchronization artifacts under project/events and project/issues generated as part of the required Kanbus workflow.