Add Terraform AWS infrastructure and enhanced CI/CD pipeline (FRE-4574)

- Terraform modules: VPC, ECS Fargate, RDS PostgreSQL, ElastiCache Redis, S3, Secrets Manager, CloudWatch
- Multi-environment support: staging and production configs
- ECS auto-scaling: CPU-based scaling with configurable min/max
- CI/CD: pnpm caching, Docker Buildx, Trivy security scanning, Terraform plan on PR
- Deploy: ECS service updates with automatic rollback on health check failure
- Backup: automated RDS snapshots, S3 versioning, ElastiCache snapshots
- Monitoring: CloudWatch dashboards, CPU/memory/5xx alarms
- Rollback script for manual service rollback
- Infrastructure documentation with architecture overview

infra/modules/rds/main.tf

@@ -0,0 +1,132 @@
+variable "environment" {
+  description = "Deployment environment"
+  type        = string
+}
+
+variable "vpc_id" {
+  description = "VPC ID"
+  type        = string
+}
+
+variable "subnet_ids" {
+  description = "Private subnet IDs"
+  type        = list(string)
+}
+
+variable "security_group_id" {
+  description = "RDS security group ID"
+  type        = string
+}
+
+variable "db_name" {
+  description = "Database name"
+  type        = string
+}
+
+variable "db_instance_class" {
+  description = "RDS instance class"
+  type        = string
+}
+
+variable "multi_az" {
+  description = "Multi-AZ deployment"
+  type        = bool
+}
+
+variable "backup_retention" {
+  description = "Backup retention days"
+  type        = number
+}
+
+variable "project_name" {
+  description = "Project name"
+  type        = string
+}
+
+resource "aws_db_subnet_group" "main" {
+  name       = "${var.project_name}-${var.environment}-db-subnet"
+  subnet_ids = var.subnet_ids
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-db-subnet"
+  }
+}
+
+resource "aws_db_instance" "main" {
+  identifier = "${var.project_name}-${var.environment}-db"
+
+  engine            = "postgres"
+  engine_version    = "16.2"
+  instance_class    = var.db_instance_class
+  allocated_storage = var.environment == "production" ? 100 : 20
+
+  db_name  = var.db_name
+  username = "shieldai"
+  password = random_password.db_password.result
+
+  multi_az            = var.multi_az
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [var.security_group_id]
+
+  backup_retention_period = var.backup_retention
+  backup_window           = "03:00-04:00"
+  maintenance_window      = "sun:04:00-sun:05:00"
+
+  skip_final_snapshot       = var.environment != "production"
+  final_snapshot_identifier = "${var.project_name}-${var.environment}-final"
+
+  storage_encrypted   = true
+  storage_type        = "gp3"
+  iops                = var.environment == "production" ? 3000 : 1000
+
+  deletion_protection = var.environment == "production"
+  copy_tags_to_snapshot = true
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-db"
+  }
+}
+
+resource "random_password" "db_password" {
+  length  = 16
+  special = true
+
+  keepers = {
+    environment = var.environment
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "db_password" {
+  secret_id = aws_secretsmanager_secret.db_password.id
+  secret_string = jsonencode({
+    username = "shieldai"
+    password = random_password.db_password.result
+    engine   = "postgres"
+    host     = aws_db_instance.main.address
+    port     = aws_db_instance.main.port
+  })
+}
+
+resource "aws_secretsmanager_secret" "db_password" {
+  name = "${var.project_name}-${var.environment}-db-password"
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-db-password"
+  }
+}
+
+output "db_endpoint" {
+  description = "RDS endpoint"
+  value       = aws_db_instance.main.endpoint
+  sensitive   = true
+}
+
+output "db_instance_identifier" {
+  description = "RDS instance identifier"
+  value       = aws_db_instance.main.identifier
+}
+
+output "db_password_secret_arn" {
+  description = "DB password secret ARN"
+  value       = aws_secretsmanager_secret.db_password.arn
+}