docs(infra): add READMEs to the rds, redis, secrets, and vpc Terraform modules

[Osifowora]

Description

Adds a module-level README.md to the four Terraform modules that had none, so
each one can be consumed without reading every .tf file first.

Module	New file	Issues
rds	infra/terraform/modules/rds/README.md	#320
redis	infra/terraform/modules/redis/README.md	#321
secrets	infra/terraform/modules/secrets/README.md	#322
vpc	infra/terraform/modules/vpc/README.md	#323

Each README follows the formatting conventions already used in docs/: an H1
title, a short intro paragraph, then ## sections for Overview,
Resources, Inputs, Outputs, Usage, Operational notes, and
Related — with tables for the resources/inputs/outputs, fenced code blocks
for the HCL usage example and CLI snippets, and relative links into docs/ and
the sibling modules.

What each README documents

vpc — the network foundation every other module depends on.

• The consumer table (rds, redis, eks, admin_isolation) and the fact
  that the module creates no security groups of its own.
• All 8 inputs and 4 outputs, including the note that region is declared for
  parity with the other modules but is not referenced in the module body.
• The constraints that are easy to get wrong: subnets are placed
  positionally against availability_zones, nat_gateway_count must be
  >= 1 (the private route table association divides by it) and must not
  exceed length(public_subnet_cidrs) (NAT gateways land in the first N
  public subnets).

rds — the Aurora PostgreSQL cluster.

• All 16 inputs and 4 outputs, with the sensitive ones flagged.
• allowed_cidr_blocks defaults to [], which means the security group has
  no inbound rule at all — nothing, not even the EKS node group, can reach
  the database until it is set.
• master_password is stored on the cluster resource and therefore lands in
  Terraform state, so the state must stay encrypted (the environment backends
  already use encrypt = true).
• deletion_protection defaults to true and must be cleared before a
  destroy; skip_final_snapshot is true in dev only.
• replica_count counts cluster instances and the cluster always keeps one
  writer, so cluster_endpoint is for writes and cluster_reader_endpoint is
  for read-only queries.

redis — the ElastiCache replication group.

• All 17 inputs and 4 outputs.
• replica_count maps straight to number_cache_clusters and therefore
  includes the primary — the default of 2 is one primary plus one
  replica, not two replicas.
• automatic_failover_enabled and multi_az_enabled need at least two cache
  clusters, so replica_count >= 2 whenever either flag is on.
• transit_encryption_enabled = true means the backend's REDIS_URL must use
  the rediss:// scheme (ioredis) — a plain redis:// URL fails the
  handshake.
• auth_token is required, is stored in state, and is rejected by AWS when it
  is shorter than 16 characters or contains /, ", or @.
• Changing the auth token replaces the replication group, so rotation is a
  disruptive operation.

secrets — the ADMIN_SECRET_KEY Secrets Manager container.

• All 3 inputs and 3 outputs, with the note that eks_node_role_name accepts
  either a role name or an ARN (the environments pass module.eks.node_role_arn).
• The placeholder contract: Terraform creates the container with the literal
  REPLACE_WITH_ADMIN_SECRET_KEY version and ignore_changes = [secret_string]
  keeps it from resetting whatever was injected afterwards.
• The real signing key is written out of band with
  aws secretsmanager put-secret-value, so it never enters Terraform state,
  plan output, or CI logs.
• The read policy grants only GetSecretValue and DescribeSecret on this one
  secret, attached to the EKS node role.
• Rotation is manual today: the module creates no
  aws_secretsmanager_secret_rotation resource, so the README points at the
  procedure in docs/admin-secret-management.md instead of claiming automated
  rotation.

Scope

Docs only — no .tf file was modified, and no runtime behaviour, resource
attribute, default, or output changed. All 506 added lines are new README
files.

Every relative link in the new READMEs was verified to resolve to an existing
file, and the one heading anchor (#rotation,
#automated-rotation-optional) was verified against the target document.

Related Issues

• Closes infra: add a README to the rds Terraform module #320
• Closes infra: add a README to the redis Terraform module #321
• Closes infra: add a README to the secrets Terraform module #322
• Closes infra: add a README to the vpc Terraform module #323

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Infrastructure / CI / Policy / Documentation update

🔒 Required CI Gates

• Frontend Required Gate: npm ci, npm run lint, npm run build, npm test in frontend/ (or skipped if no frontend/ changes)
• Backend Required Gate: npm ci, npm run build, npm test in backend/ (or skipped if no backend/ changes)
• Contracts Required Gate: cargo test in contracts/amana_escrow/ (or skipped if no contracts/ changes)
• Mobile Required Gate: npm ci, npm run type-check, npm run lint in mobile/ (or skipped if no mobile/ changes)

Note: Path-aware execution is enabled via dorny/paths-filter. Stacks with no changed files will report a skip-note and pass automatically. Reviewers will only review PRs once all applicable required gates are green. See Required PR CI Gates.

PR Checklist

• Code builds and passes all unit & integration tests locally (pnpm test / cargo test) — N/A, documentation-only change; no application code touched
• Documentation has been updated to reflect code changes
• Admin Regression Tests: N/A — no admin routes, controllers, middleware, or services were modified
• Secret Management: No secrets, private keys, or credentials are hardcoded. The new files only reference the existing placeholder REPLACE_WITH_ADMIN_SECRET_KEY and a redacted example key shape, matching docs/admin-secret-management.md.
• Network Isolation & Security: No infrastructure was changed. The new READMEs document the existing isolation model (private subnets, scoped security groups, admin egress policy) without altering it.

Files changed

 infra/terraform/modules/rds/README.md      | new
 infra/terraform/modules/redis/README.md    | new
 infra/terraform/modules/secrets/README.md  | new
 infra/terraform/modules/vpc/README.md      | new

How to review

1. Read infra/terraform/modules/vpc/README.md first — it is the root of the
   module dependency graph and explains how the other three consume it.
2. For each module, check the Inputs table against the variable blocks in
   that module's main.tf (name, type, default, required) and the Outputs
   table against the output blocks.
3. The Operational notes sections are the behavioural claims — they are the
   part worth a second pair of eyes, since they are derived from reading the
   .tf files rather than from running Terraform.

[drips-wave]

@Osifowora Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits