feat(terraform): AWS Fargate deployment module

Adds a terraform/ directory with an opinionated module that deploys
shared-memory to ECS Fargate behind an ALB. The module assumes the
operator already provides the VPC, RDS Postgres, ACM cert, ECR images,
and OIDC clients, and creates everything else: ECS cluster + services,
ALB, Service Connect namespace for app-embedder discovery, EFS-backed
model cache for the embedder, Secrets Manager entries, IAM roles,
CloudWatch log groups, and a one-shot migrator task definition.

Includes examples/basic/ with a worked invocation and a README covering
prerequisites, quick start, the post-apply migrator run, image updates,
DNS setup, and a security note. Main README gains a short Mode C
pointer to the terraform/ guide.

Validated with `terraform fmt -check -recursive` and
`terraform validate` against AWS provider 5.x.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

terraform/logs.tf

@@ -0,0 +1,30 @@
+# -----------------------------------------------------------------------------
+# CloudWatch log groups — one per service. The ECS task definitions reference
+# these via `awslogs-group`. Retention is configurable via var.log_retention_days.
+# -----------------------------------------------------------------------------
+
+resource "aws_cloudwatch_log_group" "app" {
+  name              = "/ecs/${var.name_prefix}/app"
+  retention_in_days = var.log_retention_days
+  tags              = local.tags
+}
+
+resource "aws_cloudwatch_log_group" "embedder" {
+  name              = "/ecs/${var.name_prefix}/embedder"
+  retention_in_days = var.log_retention_days
+  tags              = local.tags
+}
+
+resource "aws_cloudwatch_log_group" "migrator" {
+  name              = "/ecs/${var.name_prefix}/migrator"
+  retention_in_days = var.log_retention_days
+  tags              = local.tags
+}
+
+# Service Connect proxy (Envoy) logs go here. ECS writes these automatically
+# when the service has service_connect_configuration with log_configuration.
+resource "aws_cloudwatch_log_group" "service_connect" {
+  name              = "/ecs/${var.name_prefix}/service-connect"
+  retention_in_days = var.log_retention_days
+  tags              = local.tags
+}