[jaydreyer]

Summary

• add reproducible non-root Linux/AMD64 production images for FastAPI and Next.js with locked dependencies and digest-pinned bases
• implement fail-closed ALB/Cognito identity verification, trusted-header replacement, public health/readiness routes, security headers, runtime secret configuration, and request-correlated structured logs
• add protected two-phase AWS release automation: prepare immutable SHA images/task revisions while ECS is off, then migrate, deploy, verify, and roll back within an approved demo window
• add a separate protected flagship evidence gate that rejects seeded or pre-release journeys and verifies human approval, immutable preparation, explicit execution, deterministic Jira fixture evidence, and audit provenance
• document private database-role bootstrap, deployment, verification, rollback, recovery, and safe off-state operations

Refs #45

Verification

• docker compose run --rm api pytest — 298 passed
• npm test — 63 passed
• frontend typecheck, ESLint, and Next.js production build
• Ruff lint and formatting checks across src, migrations, scripts, and tests
• backend and frontend linux/amd64 production image builds plus non-root runtime/readiness smoke
• terraform fmt -check -recursive infra/terraform
• Terraform bootstrap/demo validation and terraform test — 5 passed
• actionlint for all GitHub Actions workflows
• secret-pattern scan and git diff --check
• independent read-only review completed with no remaining blocker

Deployment gate

This PR deliberately does not apply AWS resources or claim live deployment evidence. The exact Terraform plan, account/domain/cost impact, protected production environment, and post-deployment human flagship journey still require explicit human approval. Keep this PR in draft until those rollout prerequisites are accepted; after merge, preserve the successful Verify production flagship workflow URL on issue #45 before closing it.