docs(tech-design): add AuthCognitoAdmin building block design

Implementation-ready design for the AuthCognitoAdmin building block — the
server-side admin surface (user lifecycle + group membership) that AuthCognito
deliberately omits from its self-gating client-facing class. Covers API
surface, error model, per-runtime implementation, and mock parity.

Migrated from private staging repo (squashed). Internal cross-references to
docs not present in this repo have been de-linked.

Author: harsh62