[INFRA 7] Infrastructure as Code: Terraform for Render/Vercel + GitHub OIDC for Azure credentials #160

Objective

Codify the project's own infrastructure so environments are reproducible and reviewable, and remove long-lived Azure secrets from GitHub Actions.

Current state

• All hosting (Render services, Vercel projects, env vars, Postgres) is click-ops — nothing is reviewable or reproducible; playbooks/terraform/ is reserved but empty (that dir is for user remediation, not our infra)
• CI smoke tests use long-lived AZURE_CLIENT_SECRET repo secrets — rotating them is manual and forgetting is invisible

Scope

• infra/terraform/ root: Render provider (API + staging + worker services, env groups), Vercel provider (dashboard + website projects), Postgres instance
• Remote state (Terraform Cloud free tier or encrypted backend) with a documented plan/apply flow — terraform plan posted on infra PRs
• GitHub OIDC federation to Azure (workload identity federation on the service principal) so Actions exchanges a short-lived token instead of storing AZURE_CLIENT_SECRET
• Secrets inventory documented: what lives where (GitHub secrets vs Render env vars vs Terraform vars)

Depends on

• INFRA 4 ([INFRA 4] Deterministic deploys: Render deploy-hook API, staging environment, worker as separate service #157) — service topology should be settled before codifying it

Out of scope

• Application remediation templates in playbooks/terraform/ (separate feature track)

Acceptance criteria

• terraform plan reproduces the live environment with no diff
• Smoke-test workflow authenticates to Azure via OIDC; AZURE_CLIENT_SECRET deleted from repo secrets
• CI passes, base branch dev

Category

Infrastructure / IaC