Add --account flag for account selection in lstk aws

[peter-smith-phd]

Motivation

Prior to this PR, lstk terraform and lstk sam had accepted --account to target a specific LocalStack account, but lstk aws did not support --account. It did support the AWS_ACCESS_KEY_ID environment variable, but that only worked on a fresh machine and then silently stopped once lstk setup aws was run (to create config.toml). This happened because lstk was passing --profile localstack, which caused Botocore to ignore all the environment variables.

Solution

This PR adds lstk aws --account <12 digits>, following the terraform/sam convention.

Also included are some smaller fixes found along the way, thanks for exhaustive manual testing:

• terraform's S3 backend provisioning had been ignoring the resolved account, creating the state bucket in a different account than the generated backend block addressed.
• lstk sam --region was silently overridden by a region in samconfig.toml; it is now also passed on sam's command line, and only when explicitly given.
• lstk's leading flags now parse in any order relative to the wrapped tool's own — lstk aws --region X --account Y … used to leak --account to the AWS CLI, while the reverse order worked.

Docs

• New lstk aws --account <id> — 12 digits, before the AWS service name, falling back to AWS_ACCESS_KEY_ID then the default 000000000000.
• lstk sam --region now takes effect over samconfig.toml; without the flag, samconfig.toml still decides.

Help text is updated in place; lstk docs regenerates from it.

Closes DEVX-1039

Co-Authored-By: Claude noreply@anthropic.com