reliability: reserved concurrency on capture + enrich

[jonmatum]

Priority: P1
Parent: #34
Promotes: REL-4 from #28

Context

No Lambda has reserved concurrency configured. A runaway client or a bug loop can consume the account-level concurrency pool and starve every other function (search, graph, surfacing).

Requirements

• capture: reserved concurrency 10 (tune from load test)
• enrich: reserved concurrency 5 (Bedrock is the scarce resource)
• Read-path Lambdas (search, graph): reserved concurrency 20 each
• Async Lambdas (connect, flag, surfacing): leave unreserved or set to 2 each
• CloudWatch alarm on ConcurrentExecutions hitting the reserved ceiling (capacity starvation signal)

Acceptance criteria

• Terraform applied in both envs
• Burst test past the ceiling triggers throttling on the bursting function without affecting others
• Alarm fires and routes to the critical SNS topic (see ops: SLOs, CloudWatch dashboard, alert routing #38)

References

• Production readiness — consolidated plan (tracking) #34 (parent)
• AWS Well-Architected Framework assessment — gaps and remediation plan #28 REL-4