Move ECS tasks to private subnets with VPC endpoints

[keithataylor]

Summary

• Move ECS/Fargate app service from public subnets to private app subnets
• Disable public IP assignment for ECS app tasks
• Add VPC endpoints for ECR API, ECR Docker registry, CloudWatch Logs, Secrets Manager, and S3
• Add explicit private app route table for S3 gateway endpoint routing
• Tighten app task HTTPS egress from broad 0.0.0.0/0 to AWS service endpoints
• Add/update AWS deployment and operator documentation

Verified

• terraform fmt
• terraform validate
• terraform plan
• Applied Terraform changes successfully
• ECS service reports assignPublicIp = DISABLED
• Running ECS task ENI has no public IP
• VPC endpoints are available
• /health through the ALB returns {"status":"ok"}
• Final Terraform plan reports no changes