Implement `resources` — list AWS resources via Resource Groups Tagging API

Implementation issue split out from #107.

Replace the mock-data body in packages/ts-cloud/bin/commands/cost.ts (resources command) with real implementation:

• Use AWS Resource Groups Tagging API (tagging:GetResources) for a unified resource list across services. Falls back to per-service Describe* / List* calls if tagging is incomplete.
• Honor the existing --type <ec2|rds|s3|...> filter.

Acceptance

• cloud resources lists actual resources in the connected account.
• --type filters by resource type.
• --profile honored.
• Replaces the cli.warn('not implemented') guard introduced by #107.

Notes

• "Total Cost/mo" column probably needs to come from a Cost Explorer call grouped by RESOURCE_ID — that's only available with CUR (Cost and Usage Reports) configured. If CUR isn't set up, blank that column or document the prereq.

Related

• #107 — tactical guard

Roadmap relationship: tracked by #135 under master roadmap #132.

Implemented on main. cloud resources now honors --profile, --region, and --type; unions paginated Resource Groups Tagging API results with direct EC2 instance/volume/EIP, RDS, Lambda, and S3 discovery; deduplicates tagged/direct records; and reports permission failures as explicit partial-coverage warnings. The resource-cost column documents the CUR resource-ID prerequisite instead of showing fabricated values. Tests cover ARN normalization, pagination, deduplication, filtering, and degraded permissions. Strict Pickier checks and the declaration/UI production build pass.