Provision and activate the courses.datatalks.club redirect Lambda safely

[alexeygrigorev]

Parent epics: #5, #9, #10

Normative specs: 04 — Redirect Lambda, 08 — Legacy course-host redirect
Decision dependency: #16

Scope

In aws-infra, create a separate minimal Terraform workload for courses.datatalks.club: immutable Lambda, API Gateway/HTTPS catch-all, existing-safe DNS/ACM reference, generated reviewed explicit path map from #60, query preservation, 301 GET/HEAD HTML, gated tested 308 only where safe, true 404 unknowns, no-PII structured metrics/logs/alarms/cache, least-privilege role, sandbox rehearsal, instant config/DNS rollback, staged activation and observation before legacy decommission.

Non-goals

No blanket/homepage redirect, regex year stripping, unaudited unknown mapping, redirect of authenticated API clients before proof, deletion of old deployment/database in the same change, or hosted-zone recreation.

Acceptance criteria

• Activation gate proves every mapped path/destination and Decision: Inventory course API consumers before legacy-host redirects #16 consumer disposition; unsafe APIs stay direct compatibility endpoints.
• Query strings and approved suffix/case/Unicode behavior are preserved one hop; unknown paths return 404 and no PII is logged.
• GET/HEAD use 301; non-GET 308 exists only for explicitly client-tested method/body/auth cases.
• Sandbox rehearsal, load/cost/error metrics, alarms, cache behavior, TLS, deploy rollback, and DNS/config rollback pass.
• Legacy stack/database remains recoverable/read-only through approved observation window.
• [HUMAN] owner approves consumer inventory and production DNS activation.

Test scenarios

1. Generated table-driven tests for every mapped HTML/API method/query/case/Unicode and destination status; unknown/malformed paths.
2. Authorization-preservation test for each non-GET client; failure blocks that redirect only.
3. Lambda cold/warm behavior, cache, alarm, artifact rollback, sandbox DNS switch and restore.

Playwright

From legacy browser paths verify one-hop canonical destination, query behavior, certificates/calendar/public/login flows that are eligible, plus 404 and screenshots before/after switch.

Dependencies

Depends on #16, #29, #60, #67, and production cutover rehearsal #73. Activate only after browser/API consumer gate.