feat(phase-2): workstream 8 — Multi-Region Terraform Deployment

AWS environment:
- VPC (3-AZ, public + private subnets, NAT gateways, VPC endpoints for ECR/SM/CW)
- ECS Fargate service (sentryagent/agentidp) — secrets from Secrets Manager
- RDS PostgreSQL 14 (Multi-AZ, encrypted, VPC-internal, storage autoscaling)
- ElastiCache Redis 7 (primary + replica, at-rest + in-transit encryption)
- ALB with HTTPS/443, HTTP→HTTPS redirect, ACM certificate
- Route 53 alias record

GCP environment:
- VPC + private services access + Serverless VPC connector
- Cloud Run service — secrets from Secret Manager
- Cloud SQL PostgreSQL 14 (private IP, no public endpoint)
- Cloud Memorystore Redis 7 (VPC-internal, AUTH enabled)

Shared:
- 4 reusable modules: agentidp (dual AWS/GCP), rds, redis, lb
- No hardcoded secrets; all sensitive vars marked sensitive=true
- terraform.tfvars.example for both environments
- docs/devops/deployment.md — AWS + GCP step-by-step walkthrough, rollback procedures

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

terraform/modules/redis/outputs.tf

@@ -0,0 +1,34 @@
+################################################################################
+# Module: redis
+# Outputs
+################################################################################
+
+output "primary_endpoint" {
+  description = "Primary endpoint hostname for write operations. Use to construct REDIS_URL."
+  value       = aws_elasticache_replication_group.main.primary_endpoint_address
+}
+
+output "reader_endpoint" {
+  description = "Reader endpoint for read operations (load-balanced across replicas)."
+  value       = aws_elasticache_replication_group.main.reader_endpoint_address
+}
+
+output "port" {
+  description = "Port the Redis replication group listens on (always 6379)."
+  value       = aws_elasticache_replication_group.main.port
+}
+
+output "replication_group_id" {
+  description = "ID of the ElastiCache replication group."
+  value       = aws_elasticache_replication_group.main.replication_group_id
+}
+
+output "security_group_id" {
+  description = "Security group ID attached to the replication group. Use to add further ingress rules."
+  value       = aws_security_group.redis.id
+}
+
+output "redis_url" {
+  description = "Constructed REDIS_URL using the primary endpoint. Includes rediss:// (TLS) scheme when transit encryption is enabled."
+  value       = var.transit_encryption_enabled ? "rediss://${aws_elasticache_replication_group.main.primary_endpoint_address}:${aws_elasticache_replication_group.main.port}" : "redis://${aws_elasticache_replication_group.main.primary_endpoint_address}:${aws_elasticache_replication_group.main.port}"
+}