Build sponsored Easy Mode app hosting

Give starting clients a very cheap, Jaah-sponsored way to build and host small web apps (like Lovable), hosted in our existing apps AWS account. The attached report (task 13386) holds the options, costs and the chosen hosting design; build that design, plus the Easy Mode wizard and operator enablement below. ## Decisions (operator, task 13386) - One plan switch, Easy Mode, default OFF, with per-org override and caps. Turning it on for an org also turns on app hosting (no separate hosting switch). - Hosting: serverless in the existing apps AWS account — static front-end on S3 + one shared multi-tenant CloudFront distribution, back-end container on Lambda (Lambda Web Adapter), one database per app on one shared small RDS Postgres. Address `<app-slug>.apps.jaah.ai` (existing apps zone). Any small app with a back-end. - Deploy: auto on push to main, from a repo Jaah creates and owns (temporarily) in Jaah's existing GitHub org, from a template carrying the deploy workflow (per-app OIDC role scoped to that app's resources only). Repo hand-over to the client later (transfer + trust removal). - Caps (proposed defaults, plan terms with per-org overrides): 2 apps per org, 100k back-end requests/month, 10 GB egress/month, 500 MB database per app, Lambda reserved concurrency 2, optional sponsorship end date. Over cap: app paused to an "over limit" page, org notified. - Machines: Easy Mode orgs run their AI work on our shared node pool, placed automatically (Jaah picks a shared operator node with room); the operator picks no node. - AI: enabling Easy Mode also enables Jaah AI for the org and grants a sponsored starting AI credit (amount set by the operator), so no card is needed until the credit runs out. ## What to build 1. Infra (Terraform, apps account): multi-tenant CloudFront + wildcard cert for `*.apps.jaah.ai`, shared ECR, shared RDS Postgres in private subnets, NAT instance, control-plane provisioner role, per-app role module, budget alarm. 2. Plan switch + caps: `easy_mode` switch (default OFF) and the cap terms with per-org overrides, in the existing plan-terms pattern; operator UI on the org's plan. 3. Operator enablement: turning Easy Mode on for an org, in one console action, also (a) enables Jaah AI for the org and sets it to Jaah mode, (b) grants the sponsored AI credit the operator enters, (c) makes the org eligible for automatic placement on the shared node pool. The action refuses with a clear message when no shared pool node is available or the platform AI account is not configured. Turning it off stops new Easy Mode projects; existing apps keep running until paused by the operator. 4. Automatic placement: an Easy Mode project is placed on a shared operator node with capacity, chosen by Jaah; re-placed if that node is disabled. 5. Project wizard: when the org has Easy Mode, the first step asks "Easy Mode" or "Advanced Mode". Easy Mode asks only for a name (and a starter template if more than one): no repository step, no node step. Jaah creates the repo from the template, places the project automatically and provisions its hosted app. Advanced Mode is today's wizard unchanged. Orgs without Easy Mode see today's wizard with no mode question. 6. Provisioning API: `hosted_apps` table (standard entity shape); create, pause, delete; creates the CloudFront tenant, S3 prefix, Lambda, database, role and secret, the repo from template with its Actions variables. 7. Template repo + deploy workflow: Vite front-end + Express or FastAPI back-end Dockerfile, Lambda Web Adapter, deploy.yml via OIDC, migration step against the app's database. 8. Console + metering: the app's URL, last deploy and usage against caps on the project; daily usage cron, over-cap pause and notification, repo hand-over. Order: 1, 2 and 7 can run in parallel; 3 after 2; 4 after 3; 6 after 1 and 2; 5 after 4 and 6; 8 after 6 and 7. Out of scope: a separate GitHub org; a separate app apex domain; custom domains, registrar purchase and paid hosting after sponsorship (draft task 10233 stays as that later work); the always-on shared-box hosting tier. Done means: - With Easy Mode OFF for an org (the default), the project wizard is unchanged and no hosting or Easy Mode UI shows. - An operator turns Easy Mode on for a test org in the console in one action; the org then shows Jaah AI on with the sponsored credit and no card on file, and the action refuses with a readable message when no shared node or AI account exists. - A member of that org creates a project choosing Easy Mode, entering only a name: no repo or node question is shown, the project is placed on a shared node, a Jaah-owned repo exists from the template, and a push to its main branch publishes the app at `<slug>.apps.jaah.ai`, front-end and `/api` both answering. - A coder task in that project runs on the shared node using the sponsored AI credit. - Exceeding a cap pauses the app and notifies the org; the console shows usage against each cap. - An app's IAM role cannot touch another app's S3 prefix, Lambda, ECR tags or database (verified by a denied call). - Advanced Mode creates a project exactly as today's wizard does.