Terraform bootstrap: remote state bucket and DynamoDB lock

[cursor]

Parent

#105

Spec

spec/features/014-cicd-infrastructure/spec.md

What to build

Add infra/terraform/bootstrap/ that creates the S3 bucket and DynamoDB table used for Terraform remote state and locking. Bootstrap uses local state (chicken-and-egg). Include operator README section: one-time manual terraform apply from an authenticated AWS session, then configure environments/dev and environments/prod backends to point at bootstrap outputs.

End-to-end outcome: a maintainer can run bootstrap once and share remote state for all subsequent applies.

Acceptance criteria

• infra/terraform/bootstrap/ with S3 bucket (versioning, encryption, block public access) and DynamoDB lock table
• Bootstrap README documents apply order and backend configuration for child environments
• terraform validate passes locally
• Resource tags: Project=smartwealthai, ManagedBy=terraform

Blocked by

None — can start immediately

Type

HITL — first AWS apply requires human credentials and account access