Document and automate ECR Public authentication for AWS deployments

[scottgerring]

Problem

CDK's Docker image builds pull base images from public.ecr.aws. AWS rate-limits unauthenticated pulls (1/second, 10/minute), and during a multi-service build these limits are easily hit, causing builds to fail with auth errors. The workaround is to authenticate first:

aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws

This isn't documented anywhere, and the us-east-1 region requirement (regardless of deployment region) is non-obvious.

Suggested Fix

1. Add ECR Public authentication as a pre-step in the aws:deploy:local mise task so it happens automatically.

2. Document this requirement in the deployment prerequisites, noting that us-east-1 is required regardless of target region.

Part of #235