MIKE-04: deploy isolated AWS staging environment

From the PR description

MIKE-04: AWS Staging Access

AWS ALB URL

http://atlas-mike-staging-alb-1821218227.us-east-1.elb.amazonaws.com

Functional Credentials

• Email: admin@atlasgov.com
• Password: AtlasStaging2026!

Status

• Infrastructure provisioned: partial
• Application operational: yes
• Login operational: yes
• Sprint status: in progress

What's Working

• Backend health endpoint
• Supabase Auth (GoTrue) - signup, login, health
• Kong API gateway routing
• PostgREST running
• User created and login tested with JWT
• ALB native hostname over HTTP (no external domain)
• Zero references to external domains in code

Commits

1. feat(infra): isolated AWS staging infrastructure
2. feat(storage): S3 through ECS IAM roles
3. feat(containers): hardened production images
4. feat(supabase): self-hosted auth and API services
5. feat(deploy): OIDC staging deployment
6. test(config): AWS IAM storage mode tests
7. docs(sprint): checkpoint documentation

Known Limitations

• Frontend uses dev mode (production build requires CI runner)
• HTTP only (ACM cannot issue certs for *.elb.amazonaws.com)
• No Route53 custom domain (using native ALB hostname)