feat(terraform): AWS Fargate deployment module

Adds a terraform/ directory with an opinionated module that deploys
shared-memory to ECS Fargate behind an ALB. The module assumes the
operator already provides the VPC, RDS Postgres, ACM cert, ECR images,
and OIDC clients, and creates everything else: ECS cluster + services,
ALB, Service Connect namespace for app-embedder discovery, EFS-backed
model cache for the embedder, Secrets Manager entries, IAM roles,
CloudWatch log groups, and a one-shot migrator task definition.

Includes examples/basic/ with a worked invocation and a README covering
prerequisites, quick start, the post-apply migrator run, image updates,
DNS setup, and a security note. Main README gains a short Mode C
pointer to the terraform/ guide.

Validated with `terraform fmt -check -recursive` and
`terraform validate` against AWS provider 5.x.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

terraform/examples/basic/outputs.tf

@@ -0,0 +1,54 @@
+# Surface the module outputs so `terraform output` from this directory
+# gives the operator everything they need without diving into the module.
+
+output "alb_dns_name" {
+  description = "Point your Route53 record (alias) at this."
+  value       = module.shared_memory.alb_dns_name
+}
+
+output "alb_zone_id" {
+  description = "Used as alias.zone_id on aws_route53_record."
+  value       = module.shared_memory.alb_zone_id
+}
+
+output "ecs_cluster_name" {
+  description = "Pass to `aws ecs run-task --cluster`."
+  value       = module.shared_memory.ecs_cluster_name
+}
+
+output "migrator_task_definition_family" {
+  description = "Pass to `aws ecs run-task --task-definition`."
+  value       = module.shared_memory.migrator_task_definition_family
+}
+
+output "migrator_security_group_id" {
+  description = "Whitelist on RDS SG (inbound 5432)."
+  value       = module.shared_memory.migrator_security_group_id
+}
+
+output "app_security_group_id" {
+  description = "Whitelist on RDS SG (inbound 5432)."
+  value       = module.shared_memory.app_security_group_id
+}
+
+output "private_subnet_ids" {
+  description = "Echoed from input — handy for `aws ecs run-task --network-configuration`."
+  value       = module.shared_memory.private_subnet_ids_for_run_task
+}
+
+output "app_log_group_name" {
+  value = module.shared_memory.app_log_group_name
+}
+
+output "embedder_log_group_name" {
+  value = module.shared_memory.embedder_log_group_name
+}
+
+output "migrator_log_group_name" {
+  value = module.shared_memory.migrator_log_group_name
+}
+
+output "secret_arns" {
+  description = "Visibility into where the module stored its secrets."
+  value       = module.shared_memory.secret_arns
+}