SES: create auth's own IAM credentials and set Heroku config vars

[mroderick]

Depends on nothing (independent of the code change issue).

• Create a dedicated IAM user for auth email sending in eu-west-1 (Heroku region is eu, matching planner's choice for the planner migration)
• Policy scoped to ses:SendEmail, identity codebar.io, from address auth-noreply@codebar.io — verify allowed actions and condition keys against the current SES developer guide when writing the policy
• Store the access keys only as Heroku config vars on the auth app: SES_REGION, SES_ACCESS_KEY_ID, SES_SECRET_ACCESS_KEY
• Credentials must not appear anywhere in the repo

These credentials are separate from planner's SES SMTP credentials (codebar/planner#2926, which are SMTP-credential type) so either app's email credentials can be rotated or revoked without touching the other. Sending quota, suppression list, and domain/DKIM are SES account-level state already set up by the planner migration — nothing to redo here.