feat(terraform/platform/dev): provision QuanvNN datasets S3 bucket and IRSA role

[JackMaarek]

Summary

Sprint 2A — Terraform-only infrastructure for the QuanvNN ML pipeline on dev.

• New S3 bucket podyourlife-quanvnn-datasets-dev for satellite imagery patches consumed by the QuanvNN training pipeline. Versioning + SSE-S3 + full public access block + BucketOwnerEnforced ownership + 90-day noncurrent version lifecycle.
• New IRSA role assumable by system:serviceaccount:ml:quanvnn-sa via the EKS OIDC provider. Read-only S3 access (s3:ListBucket, s3:GetObject) — no write or delete permissions.
• Three new outputs: quanvnn_datasets_bucket_name, quanvnn_datasets_bucket_arn, quanvnn_irsa_role_arn.

Files in scope

• terraform/domains/platform/dev/s3.tf (new — 71 lines, 6 resources)
• terraform/domains/platform/dev/irsa.tf (modified — appends module.irsa_quanvnn, updates header comment)
• terraform/domains/platform/dev/outputs.tf (modified — appends 3 outputs alphabetically)

Pattern adherence

The IRSA role uses the existing _core/modules/aws/irsa module (matching the argocd_image_updater IRSA already in the file), not raw aws_iam_role + aws_iam_policy_document resources. The module handles trust policy construction, OIDC subject pinning, policy attachment, and tagging in one block.

Validation

• terraform fmt -check -diff — clean
• terraform init -backend=false — providers resolved (aws 5.100.0, tls 4.2.1)
• terraform validate — Success! The configuration is valid.

No terraform apply was run — out of Sprint 2A scope. Apply will happen via platform-bot env apply --env dev once the PR merges to main and the dev branch is re-hydrated.

Out of scope (Sprint 2B and beyond)

• Helm values change in kubernetes/helm/values/quanvnn-dev.yaml to set serviceAccount.irsaRoleArn and the S3_DATASETS_BUCKET env var
• Bucket data upload (operator action from a workstation, AWS CLI)
• Any Go code in platform-bot

Test plan

• CI: terraform validate job passes on the dev domain
• CI: terraform fmt job passes
• CI: tflint if configured passes
• After merge: hydrate dev branch and run terraform plan to confirm a clean creation diff (1 bucket + 5 bucket-config resources + 1 IAM role + 1 IAM policy + 1 attachment + 2 data sources)
• After apply: confirm bucket creation in eu-west-3 and IAM role visible with the expected trust policy subject system:serviceaccount:ml:quanvnn-sa