feat(ci): CI/CD pipelines with GitHub Actions OIDC

[gpazevedo]

Summary

• Add infra/modules/github-oidc/ Terraform module — creates IAM OIDC provider (conditional) and stanford-courses-ci role for GitHub Actions
• Wire OIDC module into infra root; expose ci_role_arn output to set as AWS_OIDC_ROLE_ARN secret
• Add .github/workflows/backend.yml — PR: build+test; push main: build Docker images, push to ECR, deploy to Lambda with versioned prod alias
• Add .github/workflows/infra.yml — PR: terraform validate+plan (posts plan as PR comment); push main: terraform apply

Test Plan

• After merge: run terraform apply -target=module.github_oidc and set AWS_OIDC_ROLE_ARN GitHub secret
• Open a PR touching backend/ — verify "Backend / Build & Test" check runs and passes
• Open a PR touching infra/ — verify "Infrastructure / Terraform Plan" check runs and posts plan comment
• Merge a backend change to main — verify deploy job pushes images and updates Lambda prod aliases
• Merge an infra change to main — verify terraform apply runs cleanly

🤖 Generated with Claude Code