Add admin-approved Neon previews on EC2 with automatic cleanup

[jerryzhou196]

Frontend previews currently lack an isolated running backend. This adds a manual, admin-approved deployment workflow that resolves exact frontend/backend commits, then provisions a Neon database branch and bounded API/Hasura containers on the existing EC2 instance. It creates a Vercel review URL whose API/GraphQL rewrites point to that PR's backend.

• A protected GitHub environment gates deployments; new commits require another approved request.
• EC2 enforces a capacity limit (one by default), memory/disk headroom, container limits, and a maximum 24-hour lifetime.
• A local systemd timer cleans up closed/merged PRs, expired previews, and failed attempts. Journaled ownership supports retries and lost cloud responses; EC2 compute stops before cloud cleanup.
• Adds optional TLS DATABASE_URL support to Go while preserving existing Postgres configuration, plus a synthetic Neon baseline bootstrap helper.

Start review with the setup and validation guide, then the GitHub workflow and preview/controller.py. The guide covers Neon, a dedicated Vercel project, restricted SSH, wildcard HTTPS, required admin reviewers, and the expiry timer. No cloud deployment or production configuration change has been performed.

Validation: 18 controller tests; full Go suite in the API Docker build; Hasura image build; actionlint; disposable Docker integration covering real migrations, signup, login, creating/editing reviews, and teardown. These checks also run in the added PR workflow.

Live Neon/Vercel/EC2 validation requires the documented one-time setup. This infrastructure does not fix Google OAuth or alter the frontend's existing local-only Playwright runner. Container resource limits are not a security boundary for hostile PR code on a production host. GHCR build artifacts remain in the registry; active preview resources and EC2 images are cleaned up.