Experimental frontend and Cognito user domain

[eoinsha]

This PR adds a number of suggested changes.
This is a Work in Progress

1. A custom domain is used for the Cognito hosted domain (auth.<DOMAIN>)
2. Support for sending user invitations and reset passwords with Mailgun, using a Cognito custom Lambda sender
3. A skeleton frontend Next.js application is added with Login, Reset Password and Invitation support
4. A CloudFront distribution is added to host the UI on the primary domain
5. Since the primary domain is now used for the UI, the /auth and /.share domains are hosted in a api. subdomain

TO DO:

• Add docs on user create/remove and invitation flow
• Add more unit tests
• Style Cognito hosted UI
• Integrate hosted UI into React frontend with confirmation UI to start and better "finished" page
• Sort out routing on UI - the CloudFront-hosted version is forcing a redirect to /login when not desired
• Add a better Home page in the UI

[eoinsha]

I will change this to a proper from: domain when I set up Mailgun with this!