Fix/terraform module variable mismatches

[OxDev-max]

Description

1. verify_contract_not_frozen was a no-op guard (contracts/predict-iq/src/modules/sac.rs)
   The function only called balance(), which doesn't reflect frozen status — so it always returned Ok(()) regardless of whether the contract's tokens were actually frozen, despite its name and docs implying a real check. Fixed it to check the contract's authorized() state on the token (the mechanism Classic Stellar assets use to implement freeze via SAC deauthorization), returning ErrorCode::TokenFrozen when the contract has been deauthorized. Added unit tests covering both the authorized and frozen cases.

2. Terraform root/child module variable mismatches (infrastructure/terraform/main.tf, modules/ecs/main.tf)

• Root main.tf passed database_url into the ecs module, but that module only declares db_host/db_port/db_name/db_user/db_password — none of which were being supplied. Fixed by passing the individual fields instead.
• Root main.tf passed num_cache_nodes into the redis module, but the module only declares num_cache_clusters. Renamed the argument to match.
• The ecs module's secret_arns output referenced aws_secretsmanager_secret.database_url, a resource that doesn't exist anywhere in the module. Replaced it with the real per-field db secret ARNs (db_host, db_port, db_name, db_user, db_password).

3. Production RDS had no real delete protection (infrastructure/terraform/modules/rds/main.tf)
   deletion_protection defaulted to false and was never overridden for prod by the root module or production/terraform.tfvars, and there was no prevent_destroy lifecycle guard — meaning a terraform destroy, an accidental recreation, or console deletion could wipe the production database. Now deletion_protection is forced to true whenever environment == "prod", and a lifecycle { prevent_destroy = true } block was added to the DB instance.

4. Redis had zero authentication (infrastructure/terraform/modules/redis/main.tf, root main.tf)
   redis_auth_token was declared with strong validation at the root module (implying AUTH was intended) but was never passed into the redis module, which didn't even declare a variable to receive it, and the replication group had no auth_token argument despite transit_encryption_enabled = true. Added a redis_auth_token variable to the redis module, set it as the replication group's auth_token, passed it from the root module, and embedded it into the redis_url output so the existing ECS REDIS_URL secret carries the credential to the API service without any new plumbing on the ECS side.

Type of Change

• Bug fix
• New feature
• Refactor / code cleanup
• Documentation update
• CI / tooling change
• Breaking change

Testing Done

Bundle Size

Chunk	Before	After
vendor.js
main*.js
pages/_app*.js

Checklist

• Tests pass locally
• Documentation updated (if applicable)
• No breaking changes, or breaking changes are documented above
• If you added or changed an API endpoint, regenerated the OpenAPI spec and committed the result:

  cd services/api && cargo run --bin generate-openapi > openapi.yaml
  git add openapi.yaml && git commit -m "chore: regenerate openapi.yaml"

• If you changed system architecture (new service, database, external dependency, or network boundary), updated docs/architecture.md
• Bundle size checked (if frontend changes)

Related Issues

Closes #1200
Closes #1201
Closes #1202
Closes #1203

[drips-wave]

@OxDev-max Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits