testenv: free-tier private topology (Terraform)

[nkcoder]

Closes #12. Dev/test environment to seed the golden fixture with real ENIs.

What

A fully private topology (no IGW/NAT) in a dedicated VPC, tagged project=reachr-testenv:

VPC 10.20.0.0/16
 └─ 2 private subnets (2 AZs)
     ├─ internal ALB [alb-sg] :80 -> tg :8080 -> 2x EC2 t2.micro [app-sg]
     ├─ RDS db.t3.micro Postgres [db-sg]
     └─ S3 gateway endpoint (free) -> prefix-list route
SG chain: alb-sg -:8080-> app-sg -:5432-> db-sg  (SG-references-SG)

Why

Gives us real attached ENIs (ALB/instance/RDS), a VPC endpoint + prefix-list route, and the SG-references-SG chain — exactly what we need to design the topology.json schema (#7) and seed a realistic fixture, without the non-free-tier parts (Fargate, interface endpoints, NAT).

Cost

Within the 12-month Free Tier (EC2 t2.micro / RDS db.t3.micro / 1 ALB, 750 hrs each; S3 gateway endpoint free). Tear down after capturing the fixture.

Verified

• terraform fmt clean, terraform validate passes.
• Not applied by me (uses your AWS creds + incurs cost) — you run terraform apply.