feat(cicd): add AWS ECS deploy pipeline for dev environment

[wuben154-maker]

Summary

• What: Adds AWS CI/CD scaffolding for the dev environment in us-east-1, including GitHub Actions workflows, .cicd configuration, and CDK bootstrap assets targeting ECS Fargate.
• Why: Enable OIDC-based, immutable ECR digest deployments without long-lived AWS keys or committed ARNs.

Scope

• In scope: New workflows (ci, release, cdk-bootstrap, deploy-ecs, cost-estimate), .cicd/project.yaml with backend/frontend service commands, Alembic database metadata, .cicd/env/dev.yaml, CDK bootstrap stack files, rollback runbook, and .gitignore entry for .cicd/.cache/.
• Out of scope: AWS account bootstrap, RDS provisioning, GitHub Secrets/Variables setup, removal of legacy Traefik/self-hosted deploy workflows, and the local skill/ directory.

Implementation notes (optional)

• Deployment target is ecs-fargate for the full-stack compose layout (PostgreSQL + backend + frontend).
• Secrets and ARNs remain in SSM/Secrets Manager; only secret names are referenced in git.
• Legacy deploy-staging.yml / deploy-production.yml are unchanged and coexist with the new AWS path.

Pre-merge review

• Review date: 2026-05-21
• Gate result: Critical open issues: 0
• Residual risk / follow-ups: CDK ECS bootstrap template defaults container port 8080 while the backend listens on 8000—adjust during bootstrap or post-deploy. New ci.yml overlaps existing backend test workflow; validate Docker Compose availability on runners after merge.

How to review

• Start here: .cicd/project.yaml, .cicd/env/dev.yaml, .github/workflows/release.yml, .github/workflows/deploy-ecs.yml
• Risk areas: IAM/OIDC role boundaries, ECS health-check port alignment, database migration ordering before backend deploy

Test plan

• Unit / integration: Merge PR and confirm ci workflow runs for backend and frontend matrix jobs
• Manual / E2E: After AWS bootstrap, trigger cdk-bootstrap → release (backend-only) → deploy-ecs with dev inputs
• Regression: Existing test-backend.yml and legacy deploy workflows still pass on unrelated changes

Docs & design

• DESIGN.md / design standards: N/A — no UI changes.
• Process docs: N/A — operational setup documented in .cicd/secrets/README.md and .cicd/runbooks/rollback.md.