feat(ci): OIDC deploy workflow with dev/prod branching and Secrets Manager

[Jing-yilin]

Changes

• Replace static AWS access keys with OIDC role-to-assume (more secure, no long-lived credentials)
• Dev deploy on develop push, prod deploy on main push
• Inline ECS task definition generated in CI (no stale JSON in repo)
• All secrets pulled from AWS Secrets Manager at deploy time
• Add Dockerfile.ci for pre-built binary deploy (faster image build)
• Update test workflow to use go.mod for Go version + verify linux build

Required AWS setup (see PR description)

• IAM OIDC provider for token.actions.githubusercontent.com
• IAM role kickwatch-deploy-role with OIDC trust
• GitHub secret: AWS_DEPLOY_ROLE_ARN, AWS_ACCOUNT_ID
• Secrets Manager: kickwatch(-dev)/{database-url,apns-key-id,apns-team-id,apns-bundle-id,apns-key}