Identity follow-up: stori-admin exposure, credential rotation, root-use policy

Context

Split out from #152, which is now closed. #152 resolved the core identity architecture (IAM Identity Center, individual SSO, no root access keys anywhere) and produced a full IAM user inventory for Nonproduction that was previously impossible to see (iam:ListUsers was denied).

Remaining items

• stori-admin has full AdministratorAccess to the shared Nonproduction account — via a static, unrotated key active since 2026-01-29. This account also hosts MuseHub's staging environment. Needs a conversation with whoever manages Stori's AWS access before anything is changed here — not something to resolve unilaterally. Options once that conversation happens: scope the policy down to what Stori actually needs, rotate the key, or move to a time-limited/STS-based credential.
• Long-lived static access keys, never rotated — musehub-infra (since 2026-04-05, though no longer used by push.sh as of #150), musehub-app (since 2026-04-05), stori-assets-app (since 2026-01-30). None of MuseHub's checklist "temporary credentials everywhere" ask is satisfied for these.
• stori-assets-app's EC2FullAccess — broader than an "assets app" name suggests. Worth confirming with whoever manages Stori's side whether this is actually needed.
• Documented legitimate root uses / multi-person root approval policy — the mechanism (centralized root access management) exists, but there's no written policy for when root/ privileged-session access is appropriate to use.
• Retire musehub-infra fully — depends on #175 (other scripts still reference it).

Not urgent

musehub-infra and musehub-app's access keys are July/April creation dates respectively — not ancient, but with no rotation cadence defined, they'll just keep aging. Worth deciding on a rotation policy once the above is sorted, not before.