MIKE-04B: recover AWS staging frontend and S3 readiness (#7)

* feat(infra): add isolated aws staging infrastructure

- ALB with HTTP listener (native hostname, no custom domain)
- Target groups for frontend, backend, and supabase (Kong)
- Listener rules for /supabase/* and backend API paths
- Security groups for ALB, frontend, backend, and supabase
- ECR repos for frontend, backend, and kong images
- S3 buckets for documents and terraform state
- Secrets Manager for application secrets
- IAM roles for task execution, task runtime, and GitHub OIDC deploy
- CloudWatch log groups and alarms
- Budget alert at 80% of $50/month
- No external domain references - fully isolated

* feat(storage): support s3 through ecs iam roles

- Environment validation accepts S3_* variables for production
- S3_BUCKET_NAME and S3_REGION injected via Secrets Manager
- Storage layer uses IAM role credentials (no static keys)

* feat(containers): add hardened production images

- Backend Dockerfile.prod: multi-stage build, non-root user, healthcheck
- Frontend Dockerfile.prod: multi-stage build with placeholder env vars
- Frontend Dockerfile.staging: dev mode for fast iteration on ECS

* feat(supabase): add self-hosted auth and api services

- Kong API gateway with declarative config (key-auth, CORS)
- GoTrue v2.164.0 with MFA, refresh token rotation, admin API
- PostgREST v12.2.3 for REST API over PostgreSQL
- Custom Kong Docker image with entrypoint for key substitution
- ECS task definition for Fargate (3 containers, shared namespace)
- init-db.sh creates schema and roles (GoTrue handles tables via migrations)
- Kong routes use /supabase/ prefix with strip_path for ALB compatibility
- Kong services use localhost (ECS awsvpc shared network namespace)

* feat(deploy): add oidc staging deployment

- GitHub Actions workflow with AWS OIDC authentication
- Builds and pushes backend, frontend, and kong images to ECR
- Registers ECS task definitions and updates services
- Smoke test against native ALB hostname
- No long-lived AWS credentials (OIDC only)

* test(config): cover aws iam storage mode

- Tests for S3_* environment variable validation
- Tests for production storage configuration

* docs(sprint): document aws staging checkpoint

- Architecture diagram (ALB → frontend/backend/supabase)
- AWS resource inventory (all prefixed atlas-mike-staging-)
- GoTrue migration fix (search_path for pop migration library)
- Kong gateway fix history (permissions, entrypoint, routing)
- Functional credentials for testing
- Status: infrastructure partial, application operational, login operational

* fix(storage): use ecs task role for s3 access

- Remove forced static credentials in S3Client initialization
- Support IAM role mode (default credential provider chain)
- storageEnabled now checks bucket name, not static credentials
- Update requireStorageConfig error message for IAM mode

fix(frontend): use production build with real env vars

- Dockerfile.prod uses build args for NEXT_PUBLIC_* vars
- Health endpoint returns independent 200 response
- Remove dev mode from staging

* fix(frontend): move tw-animate-css to dependencies for production build

Turbopack in Docker could not resolve tw-animate-css from devDependencies
during npm run build. Moving to dependencies ensures it's always available.

* fix(frontend): copy postcss.config.mjs to docker build

Turbopack could not resolve tw-animate-css CSS @import without
postcss.config.mjs present in the build context.

* fix(infra): correct terraform attribute names and budget notification type

- repository_uri → repository_url (AWS provider v5 API change)
- notification_type EMAIL → ACTUAL (valid enum value)
- terraform fmt applied

* docs(staging): document recovery, incidents, and operations

- MIKE-04B-AWS-STAGING-RECOVERY-RESULT.md: sprint result
- MIKE-STAGING-FRONTEND-UNAVAILABLE.md: incident report
- MIKE-STAGING-S3-READINESS.md: incident report
- AWS-STAGING-SMOKE.md: smoke test runbook
- AWS-STAGING-ACCESS.md: access guide

* fix(frontend): add timestamp to health endpoint and fix gitleaks false positive

- Health route now returns timestamp (test expects it)
- Smoke doc: replace hardcoded 'not-a-real-token' with env var placeholder
- Add comment explaining ANON_KEY should be replaced

* fix(security): add gitleaksignore for false positive in smoke doc

The curl-auth-header rule matches a placeholder token in documentation.
This is not a real secret - it's a shell variable reference.

---------

Co-authored-by: Januário <januario@Januarios-Mac-mini.local>