Set up GitHub Actions deployment for both environments

[asmithml]

Part of #33

Depends on: Deploy production infrastructure, Make EC2 user data environment-aware

Context

The current deployment pulls the API deploy script at EC2 boot time via user data:

curl -L https://raw.githubusercontent.com/fieldsoftheworld/ftw-inference-api/main/deploy.sh | bash

This needs to move to GitHub Actions in the ftw-inference-api repo so deployments are controlled, repeatable, and environment-aware.

Requirements

1. GitHub Actions workflow in the ftw-inference-api repo that can deploy to either environment
2. Environment selection (prod/dev) as a workflow input or triggered by branch/tag
3. The workflow should:
   • Build/package the application
   • Deploy to the target EC2 instances (via SSM Run Command, CodeDeploy, or ASG instance refresh)
   • Pass the correct environment config (DynamoDB prefix, SQS queue names, Source Coop secret name)
4. AWS credentials via GitHub OIDC or stored secrets for the 676206917878 account

Considerations

• The ASG instance refresh strategy is already configured in Terraform. A deployment could update the launch template user data and trigger a refresh.
• Alternatively, SSM Run Command can run a deploy script on existing instances without replacing them.
• The user data script should still bootstrap a working instance on first launch (for ASG scaling events), but ongoing deployments should use GitHub Actions.

Note

This task is primarily in the ftw-inference-api repo but may require changes to this repo's EC2 module (launch template, user data) and IAM module (GitHub Actions OIDC role).