GitLab

Replace the v1.2.0 Lambda/DynamoDB/token-auth backend with the same
deployment shape as ccc-bundle-monitor:

- Python/Flask app (app/, serve.py) serving the static frontend + /api/*
- PostgreSQL on shared RDS, schema via Alembic (migrations/), one `days` table
- Docker on shared ECS Fargate; CDK stack (cdk/) imports shared VPC/cluster/ALB/Cognito
- Auth at the ALB via the shared Cognito pool, with one deliberate divergence:
  public read + Cognito-gated write using two listener rules (signin=AUTHENTICATE,
  app=ALLOW), so anonymous viewers can see the board
- GitLab CI rewritten to the two-stage migrate -> cdk deploy pipeline
- Frontend moved to static/index.html; sync layer rewritten for same-origin
  /api/* and /signin redirect auth (no in-page password/token)
- Removed backend/ (Lambda+DynamoDB) and deploy/ (S3/nginx); docs updated
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>