feat(ci): add production deployment workflows

[zhangc110033]

Summary

• Add PR verification for typecheck, tests, builds, and Terraform validation.
• Add a manually triggered production deployment workflow.
• Build API and Worker images with immutable full Git SHA tags.
• Run Terraform plan/apply and deploy both ECS services in one workflow.
• Add pre-deployment restore points and a separate rollback workflow.
• Use the existing KMS-encrypted S3 Terraform backend.
• Add .dockerignore to exclude local credentials, Terraform files, and build caches.
• Fix three stale/flaky tests so the verification workflow passes.

Deployment behavior

Merging this PR does not deploy production.

Production deployment requires manually running Deploy production from the
main branch. The workflow:

1. Builds and pushes API and Worker images tagged with github.sha.
2. Records the currently deployed Task Definition pair.
3. Creates a Terraform plan.
4. Saves a temporary restore point.
5. Applies Terraform and waits for both ECS services to become stable.
6. Records the successful API/Worker release pair.

Database migrations are not included.

Terraform review

A read-only production plan was executed against the existing S3 State.

Expected changes:

• Make both ECR repositories immutable.
• Add ECS Cluster tags.
• Register new API and Worker Task Definition revisions.
• Point both ECS Services to the new revisions.

Confirmed unchanged:

• API and Worker desired counts
• VPC and Subnets
• Security Groups
• RDS and Redis
• SQS and S3

No Terraform apply was executed during review.

Validation

• Node.js 22 typecheck passed
• 23 test suites passed
• 118 tests passed
• API and Worker builds passed
• Workflow YAML, Actionlint, and Shell validation passed
• Terraform fmt and validate passed
• Production read-only Terraform plan reviewed
• Sensitive-file pattern scan passed

After merge

1. Let Verify run once on GitHub.
2. Configure Verify as a required main status check.
3. Manually run Deploy production when ready.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7bd647707f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sanshuiyijing]

LGTM