feat(H-041): GitHub Actions CI/CD deploy + SSM secrets management

[dashprotocol]

Closes #53

Summary

• Automates production deploys on push to main via GitHub Actions
• Migrates production secrets from a manually-maintained .env file to AWS SSM Parameter Store
• GitHub Actions authenticates to AWS via OIDC — no static credentials stored in GitHub secrets or on the server
• Deploy job fetches secrets from SSM, validates all required keys are present and non-empty, SCPs .env files to the server, and runs deploy.sh over SSH
• Adds Terraform resources for the GitHub OIDC provider and a least-privilege IAM role scoped to SSM reads on /havenhold/prod/*

Key decisions

Decision	Choice
AWS auth	OIDC federation — short-lived credentials per workflow run, no long-lived keys
Secrets store	SSM Parameter Store (SecureString)
.env on server	Written at deploy time by CI runner; Lightsail has no instance profile so the app cannot fetch from SSM directly
Known-hosts	Pinned DEPLOY_KNOWN_HOST secret — no TOFU risk
Action versioning	SHA-pinned aws-actions/configure-aws-credentials

Test plan

• CI jobs (frontend, backend) pass on this PR
• Deploy job shows as skipped on this PR (expected — only runs on push to main)
• After merge: OIDC credentials step shows assumed role ARN
• After merge: SSM validation prints All required parameters present and non-empty
• After merge: deploy completes all 12 steps and health check returns HTTP 200