ecs and/or eks deploy for the backend cluster

[cazlo]

re-use IAM roles from the CDK stacks for least priv access

for eks would use IRSA + uniq serviceAccount per app