Harden reliability controls and release v1.2.0

[krishna310301]

Summary

• add read-only AWS presentation mode, CIDR-restricted ingress, and split liveness/readiness semantics
• make Checkov blocking with reviewed resource-level exceptions and stronger Terraform defaults
• connect measured Prometheus request SLIs to the dashboard and add multi-window burn-rate alerts
• add reproducible local database recovery evidence with explicit AWS claim boundaries
• harden Kubernetes workloads with restricted security contexts, disruption budgets, and scoped NetworkPolicies
• align release documentation and evidence language for v1.2.0

Validation

• 27 Python tests passed
• 3 frontend behavior tests passed; production build passed
• npm audit found 0 vulnerabilities
• Terraform format, validation, and cost/security guardrails passed
• Checkov: 101 passed, 0 failed, 31 accepted exceptions
• Prometheus: 8 rules validated; behavior tests passed
• Helm lint and rendered observability/NetworkPolicy contracts passed
• kubeconform: 36 resources valid, 0 invalid
• frontend image ran as non-root with a read-only root filesystem

Evidence boundary

The committed recovery drill validates local PostgreSQL reconnection and health semantics. It does not claim EKS node recovery, RDS failover, production capacity, or long-window SLO compliance.