Adds default_tags to AWS provider

[mcrundo]

Summary

Adds default_tags to the AWS provider so every taggable resource in this stack carries consistent
Project, Environment, ManagedBy, and Repository tags without per-resource edits.

Closes LAD-287.

Change

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      Project     = "address-validation"
      Environment = var.environment
      ManagedBy   = "terraform"
      Repository  = "address-validation-service"
    }
  }
}

One block covers every resource that supports tags. No per-resource edits needed.

Why

- Cost allocation. AWS Cost Explorer and Cost Allocation Reports can filter/group by tag. Without this,
this service's spend is invisible against other work in the account.
- Resource discovery. Tag-based search in the console and Resource Groups answers "what belongs to
address-validation?" without guessing by name prefix.
- Ownership clarity. ManagedBy = "terraform" signals to anyone poking around the console that these
resources shouldn't be modified by hand.

What to expect in terraform plan

Every taggable resource shows an in-place update to add the four tags — noisy but fully non-destructive.
 Includes Lambda functions, log groups, SQS DLQ, SNS topic (when alarm_email is set), API Gateway (where
 supported), Secrets Manager secrets, IAM role.

Resources that don't support tags (e.g. aws_cloudwatch_metric_alarm, aws_iam_role_policy,
aws_lambda_permission, aws_apigatewayv2_authorizer) won't appear in the diff.