fix(iac/aws): gate migration-failure alarm to unblock deploys

[cristim]

Problem

#1124's migration-failure CloudWatch metric filter (terraform/modules/compute/aws/lambda/migration-alarm.tf) needs logs:PutMetricFilter, which the CI deploy SA (cudly-terraform-deploy/GitHubActions) does not hold. Every terraform apply now 403s at that resource and all deploys fail (the Lambda code updates first, so the app looks deployed while the pipeline is red).

Fix

Gate the metric filter + alarm behind a new enable_migration_alarm variable (default false), so deploys succeed without the permission. This is the bootstrap-vs-runtime IAM split from CLAUDE.md.

To enable the alarm later

Grant logs:PutMetricFilter/DeleteMetricFilter/DescribeMetricFilters to the deploy SA in terraform/environments/aws/ci-cd-permissions/, re-apply that bootstrap (privileged human), then set enable_migration_alarm=true. (Follow-up.)

Verified: terraform fmt clean; pre-commit hooks pass.

Summary by CodeRabbit

Release Notes

New Features

• Added optional migration alarm monitoring to track and alert on migration failures
• Users can now enable CloudWatch metric filtering and alerting for migration events through a new configuration option
• Migration failure monitoring can be controlled per deployment environment

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7129d9bc-9daf-460a-a35e-ae779dce04f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/migration-alarm-deploy-block

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}