Aws architecture upates

[ekremarmagankarakas]

AWS infrastructure and CI/CD updates made. Not yet applied to a live environment

See docs/MIGRATE_INFRA.md for the deployment guide.

• VPC — Custom VPC with private subnets for ECS/RDS, NAT gateways, VPC endpoints for S3/ECR/Secrets Manager
• Credentials — OIDC for GitHub Actions, IAM task role for ECS. Removed long-lived AWS keys from application
• Secrets Manager — DATABASE_URL (auto-constructed from RDS endpoint) and SECRET_KEY removed from plaintext env vars
• RDS — Encryption at rest, 7-day backups, final snapshot on destroy
• Route53 + ACM — Hosted zone and TLS certificate fully managed by Terraform
• Terraform — Restructured into a reusable module with separate prod/staging roots and state backends
• CI/CD — New workflows replacing the old ones; deploys use OIDC and read config from SSM
• Bug fixes — Dockerfile healthcheck was pointing to /docs (disabled in prod); backend required unused AWS credential fields that would have caused ECS startup failures

Before deploying (Merging)

• Create ECR repos and Terraform state buckets in each AWS account
• Run terraform apply in prod and staging
• Update nameservers at domain registrar
• Add AWS_GITHUB_ACTIONS_ROLE_ARN_PROD and AWS_GITHUB_ACTIONS_ROLE_ARN_STAGING to GitHub secrets
• Remove old AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY secrets from GitHub