Add CI that replicates the platform network and tests the application

[HarshCasper]

The repo had no CI, and a fresh terraform init in terraform/application failed: the ECS and API Gateway v2 modules were unpinned, and their latest versions need AWS provider v6 while the provider is pinned to 5.60.0.

The README workflow needs a real AWS account for the platform. CI runs the same steps with a second LocalStack account (111111111111) standing in for it:

1. make deploy-platform-local deploys the platform VPC into account 111111111111.
2. make deploy-application fails, as the README describes, because the VPC and subnets are not in account 000000000000. CI checks that it fails on the missing network.
3. make replicate-local replicates the VPC and the 3 private subnets into account 000000000000. It uses the Replicator HTTP API, whose source_aws_config.endpoint_url points at LocalStack. It sets target_aws_config explicitly: without it, the job tried to create the VPC in the source account and failed with InvalidVpc.DuplicateCustomId.
4. make deploy-application succeeds.
5. make test checks:
   • the replicated VPC and subnets have the same IDs, CIDRs and availability zones as in the platform account
   • the ECS service runs its task
   • the internal ALB returns the app's response
   • the HTTP API returns it through its VPC link to the ALB
   • an event posted to the REST API reaches the my-queue SQS queue

Sample fixes:

• Pin terraform-aws-modules/ecs/aws to ~> 5.12 and apigateway-v2 to ~> 5.3, and allow AWS provider ~> 5.60 in the application.
• The container mapped host port 80 to container port 3000. With networkMode = awsvpc, ECS requires them to match, and RegisterTaskDefinition rejected it. The host port is now the container port.
• The REST API to SQS request template called $input.json() without a path, which made LocalStack return 500, and put unencoded JSON into the form body. It now sends MessageBody=$util.urlEncode($input.json('$')).
• make deploy-application now runs lstk tf init, selects or creates the local workspace, and deploys with lstk tf. Before, it ran terraform apply with no init and a TF_WORKSPACE that did not exist yet.
• README: a section for the workflow without an AWS account, a test section, and the CDK commands. The CDK targets use paths from the repository root, so they run as make -f cdk/Makefile <target>, not from cdk/.

Not covered: replication from a real AWS account (localstack replicator start with AWS credentials) and the CDK variant. CI verifies the Terraform variant only.

https://claude.ai/code/session_01DZfDmzUBPqNAu3yFKyfCNM