refactor: remove hard-coded AWS credentials, use ECS task IAM role

[josephevans]

Summary

Removes all hard-coded AWS credentials across the codebase, replacing them with ECS task IAM role permissions. Also improves Route53 DNS record handling to prevent accidental overwrites.

Changes

• organization/controllers_fastly.py — use task role for Route53 updates
• apis_v1/views/views_extension.py — remove hard-coded credentials
• email_outbound/functions.py — remove hard-coded credentials
• image/models.py — remove hard-coded credentials
• retrieve_tables/controllers_master.py — remove hard-coded credentials

Additional Fixes

• Check for any existing DNS record type (not just CNAMEs) before adding a new Route53 record, preventing accidental overrides of required infrastructure records

Motivation

Hard-coded credentials are a security liability. Using the ECS task role is the AWS-recommended approach — no secrets to rotate, no risk of leakage, and proper least-privilege access.

[josephevans]

Updated legacy ECS task permissions so this can be merged now.

[DaleMcGrew]

@josephevans can we wait to update this for a couple of weeks while we get the developers up-to-speed on Docker? (If not we lose the ability to use image uploading locally.)