Add Terraform AWS infrastructure and enhanced CI/CD pipeline (FRE-4574)

- Terraform modules: VPC, ECS Fargate, RDS PostgreSQL, ElastiCache Redis, S3, Secrets Manager, CloudWatch
- Multi-environment support: staging and production configs
- ECS auto-scaling: CPU-based scaling with configurable min/max
- CI/CD: pnpm caching, Docker Buildx, Trivy security scanning, Terraform plan on PR
- Deploy: ECS service updates with automatic rollback on health check failure
- Backup: automated RDS snapshots, S3 versioning, ElastiCache snapshots
- Monitoring: CloudWatch dashboards, CPU/memory/5xx alarms
- Rollback script for manual service rollback
- Infrastructure documentation with architecture overview

.github/workflows/ci.yml

@@ -24,11 +24,14 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: "npm"
+          cache: "pnpm"
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Run linter
-        run: npm run lint
+        run: pnpm lint
 
   typecheck:
     name: Type Check
@@ -39,11 +42,14 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: "npm"
+          cache: "pnpm"
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Build all packages
-        run: npm run build
+        run: pnpm build
 
   test:
     name: Test Suite
@@ -77,15 +83,14 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: "npm"
+          cache: "pnpm"
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
       - name: Install dependencies
-        run: npm ci
-      - name: Generate Prisma client
-        run: npx prisma generate --schema=packages/db/prisma/schema.prisma
-        env:
-          DATABASE_URL: "postgresql://shieldai:shieldai_dev@localhost:5432/shieldai"
+        run: pnpm install --frozen-lockfile
       - name: Run tests with coverage
-        run: npm run test:coverage
+        run: pnpm test:coverage
         env:
           DATABASE_URL: "postgresql://shieldai:shieldai_dev@localhost:5432/shieldai"
           REDIS_URL: "redis://localhost:6379"
@@ -100,8 +105,9 @@ jobs:
   docker-build:
     name: Docker Build
     runs-on: ubuntu-latest
-    needs: [lint, typecheck]
+    needs: [lint, typecheck, test]
     strategy:
+      fail-fast: false
       matrix:
         include:
           - name: api
@@ -118,6 +124,8 @@ jobs:
             dockerfile: services/voiceprint/Dockerfile
     steps:
       - uses: actions/checkout@v4
+      - name: Docker Buildx
+        uses: docker/setup-buildx-action@v3
       - name: Build Docker image
         uses: docker/build-push-action@v5
         with:
@@ -127,3 +135,45 @@ jobs:
           tags: shieldai-${{ matrix.name }}:${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  security-scan:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    needs: [lint]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run npm audit
+        run: pnpm audit --prod
+        continue-on-error: true
+      - name: Trivy filesystem scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: fs
+          scan-ref: "."
+          format: table
+          exit-code: 1
+          ignore-unfixed: true
+          severity: CRITICAL,HIGH
+
+  terraform-plan:
+    name: Terraform Plan
+    runs-on: ubuntu-latest
+    needs: [lint]
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Terraform Format
+        working-directory: infra
+        run: terraform fmt -check -diff
+      - name: Terraform Init
+        working-directory: infra
+        run: terraform init
+      - name: Terraform Validate
+        working-directory: infra
+        run: terraform validate
+      - name: Terraform Plan
+        working-directory: infra
+        run: terraform plan -var-file=environments/staging/terraform.tfvars.example -no-color
+        env:
+          TF_VAR_hibp_api_key: ${{ secrets.HIBP_API_KEY }}
+          TF_VAR_resend_api_key: ${{ secrets.RESEND_API_KEY }}