The amplify gen2-migration lock command already enables deletion protection on DynamoDB tables to safeguard stateful resources during migration. This PR extends that same protection to Cognito User Pools.

What changed:

• Added userPoolIds() method that reads User Pool IDs from amplify-meta.json via stateManager.getMeta(), filtering auth resources where service === 'Cognito'
• Added cognitoClient() lazy accessor for CognitoIdentityProviderClient
• In execute(): for each discovered User Pool, pushes an operation that calls UpdateUserPoolCommand with DeletionProtection: 'ACTIVE'
• In rollback(): follows the existing DynamoDB pattern — pushes a no-op "preserve" operation since the original protection state is unknown

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.