infra: alarm on ALB target 5XX responses

[cqnykamp]

Summary

• Adds an Alb5xxAlarm CloudWatch alarm in service-common.yml that fires on the ALB's HTTPCode_Target_5XX_Count metric (>= 1 over a 1-minute period) and notifies the critical SNS topic.
• Gated on the existing LbIsEnabled condition so stacks without a load balancer are unaffected.

Test plan

• Deploy to dev3 and confirm the alarm resource is created.
• Force a 5XX response from a target (e.g. temporary handler) and verify the alarm transitions to ALARM and the SNS notification is delivered.
• Confirm normal 2xx traffic keeps the alarm in OK.