[service-infra] Add database integration, containerization, CI/CD, observability, and Kubernetes manifests

[devin-ai-integration]

Summary

Adds the full service infrastructure layer to the todo app, replacing the in-memory prototype with production-ready foundations across five areas:

1. Database Integration — PostgreSQL via pg with connection pooling, a migration framework (backend/migrations/) with up/down support, and a model layer (backend/models/todo.js) using parameterized queries. In-memory array storage in routes/todos.js is fully replaced.

2. Containerization — Multi-stage Dockerfile.backend (node:18-alpine), Dockerfile.frontend (nginx:alpine with reverse proxy config), and docker-compose.yml orchestrating backend, frontend, PostgreSQL, Redis, and a one-shot migration service. .dockerignore included to prevent node_modules/ leaking into image builds.

3. CI/CD — .github/workflows/ci.yml (lint → test → build Docker images) and cd.yml (build+push to GHCR → staging auto-deploy → production with manual approval). Husky pre-commit hook for lint and basic regex secret scanning.

4. Observability — Winston structured JSON logger, correlation ID middleware (UUID v4, propagated via X-Correlation-ID), Prometheus metrics (request count, response time histogram, error rate, active connections) on /metrics. Documented in OBSERVABILITY.md.

5. Kubernetes — Full k8s/ directory: Deployment (with security contexts, resource limits, liveness/readiness probes), Service, Ingress, ConfigMap, Secret template, HPA, and a DB migration Job. Standard labels (team, service, environment, cost-center) applied throughout.

All error responses follow the { error: { code, message, details } } format and env vars use the TODO_APP_ prefix per CONVENTIONS.md.

Updates since initial revision

• Added .dockerignore to prevent local node_modules/ from overriding the clean install in the Docker deps stage.
• Fixed K8s image refs in deployment.yaml and migration-job.yaml to match the CD pipeline (ghcr.io/cognition-partner-workshops/prototype-1/…).
• Removed nginx.ingress.kubernetes.io/rewrite-target: / annotation from ingress.yaml which would have stripped path prefixes and broken API routing.
• Fixed pre-commit hook to run cd backend in a subshell so the working directory is preserved for the subsequent secret scanning step.

Review & Testing Checklist for Human

• CI lint/test are no-ops: npm run lint echoes a string and npm test also echoes — CI will always pass. Verify this is acceptable as a placeholder until the unit-tests workstream lands.
• No integration/unit tests for new code: The migration runner, DB model layer, and middleware are entirely untested. Manual verification or a follow-up test workstream is needed before trusting these in production.
• k8s/secret.yaml contains placeholder values: The base64-encoded CHANGE_ME values must be replaced before any real cluster deployment. Confirm this template-only approach is acceptable for the repo.
• Pre-commit secret scanning is regex-based: The grep pattern is a basic heuristic — it may produce false positives on config templates (like .env.example) or miss obfuscated secrets. Consider replacing with a dedicated tool (e.g., gitleaks, detect-secrets) in a future iteration.

Suggested manual test plan:

1. Run docker compose up --build and verify all services start and the migration runs
2. Hit GET /health, GET /health/ready, GET /metrics, and the CRUD endpoints against the running backend
3. Verify docker compose down + docker compose up preserves data (volume persistence)

Notes

• The uuid package emits a CommonJS loading ES Module experimental warning at require-time. Harmless in Node 18+ but may be noisy in logs.
• Redis is included in docker-compose but not yet consumed by application code — it's scaffolding for the rate-limiting / session work in the app-core workstream.
• The CD workflow triggers on push to main only; this PR targets productionize, so CD won't fire from this merge.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/854827350b68447eb7ccb725e0d40d3e

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring