feat(terraform): AWS Fargate deployment module

Adds a terraform/ directory with an opinionated module that deploys
shared-memory to ECS Fargate behind an ALB. The module assumes the
operator already provides the VPC, RDS Postgres, ACM cert, ECR images,
and OIDC clients, and creates everything else: ECS cluster + services,
ALB, Service Connect namespace for app-embedder discovery, EFS-backed
model cache for the embedder, Secrets Manager entries, IAM roles,
CloudWatch log groups, and a one-shot migrator task definition.

Includes examples/basic/ with a worked invocation and a README covering
prerequisites, quick start, the post-apply migrator run, image updates,
DNS setup, and a security note. Main README gains a short Mode C
pointer to the terraform/ guide.

Validated with `terraform fmt -check -recursive` and
`terraform validate` against AWS provider 5.x.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

terraform/main.tf

@@ -0,0 +1,36 @@
+# -----------------------------------------------------------------------------
+# shared-memory — AWS Fargate deployment module
+#
+# Deploys the three runtime components (app, embedder, migrator) as ECS
+# tasks behind an internet-facing ALB. The user is responsible for the VPC,
+# RDS Postgres, ACM cert, ECR images, and OIDC clients (see README).
+#
+# Region is inherited from the configured AWS provider — do not hardcode.
+# -----------------------------------------------------------------------------
+
+data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+locals {
+  # Merged tag set applied to every resource in the module. Callers can pin
+  # cost-allocation tags / environment markers via var.tags.
+  tags = merge(
+    {
+      "managed-by" = "terraform"
+      "module"     = "shared-memory"
+    },
+    var.tags,
+  )
+
+  # Public URL is the canonical external origin — feeds PUBLIC_URL, AUTH_URL,
+  # and OIDC redirect URIs alike.
+  public_url = "https://${var.domain_name}"
+
+  # Service Connect namespace name. One per module instance so multiple
+  # deployments (e.g. staging + prod in one cluster) don't collide.
+  service_connect_namespace = "${var.name_prefix}.internal"
+
+  # Port constants — keep these aligned with the Dockerfiles.
+  app_port      = 3000
+  embedder_port = 8080
+}