fix(ci): supply Terraform variables in infra workflow; fix CloudWatch dashboard

[gpazevedo]

Summary

• infra.yml: pass all required Terraform variables via TF_VAR_ env vars sourced from GitHub secrets — fixes terraform apply prompting interactively in CI
  • ALARM_EMAIL secret → TF_VAR_alarm_email
  • AMPLIFY_GITHUB_TOKEN secret → TF_VAR_github_access_token
  • Non-sensitive vars (github_owner, github_org, github_repo, create_oidc_provider) hardcoded in workflow
• CloudWatch dashboard: added missing region field to all 6 widgets — fixes InvalidParameterInput on PutDashboard
• observability module: added aws_region variable; wired from root main.tf

Secrets to add before merging

gh secret set ALARM_EMAIL --repo gpazevedo/stanford --body "you@example.com"
gh secret set AMPLIFY_GITHUB_TOKEN --repo gpazevedo/stanford --body "github_pat_..."

(Already set if you ran the commands above.)

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

Error: Error acquiring the state lock

Error message: operation error S3: PutObject, https response error
StatusCode: 412, RequestID: NR97XCRMN015XZ8C, HostID:
og/4kFqJ3G0Vol3QTe9HFN9cabtn77R7TMZ1jzslmEPmT3jaoDJKMw/kq9zTVyyYXlLdIKuUOa04GeADu1yBZwvezUEZBxVa,
api error PreconditionFailed: At least one of the pre-conditions you
specified did not hold
Lock Info:
  ID:        8b3ab3a9-8e97-686a-f5aa-22f66f8ee4c5
  Path:      stanford-courses-tfstate-234876310489/prod/terraform.tfstate
  Operation: OperationTypeApply
  Who:       runner@runnervm0kj6c
  Version:   1.14.0
  Created:   2026-03-16 02:17:31.447737025 +0000 UTC
  Info:      


Terraform acquires a state lock to protect the state from being written
by multiple users at the same time. Please resolve the issue above and try
again. For most commands, you can disable locking with the "-lock=false"
flag, but this is not recommended.
::error::Terraform exited with code 1.