Add AWS migration architecture package (docs only)

[devin-ai-integration]

Summary

Docs-only. Adds docs/architecture/ with four documents derived by reading the source, build files,
K8s/Helm manifests, Jenkinsfiles, shared library, Compose, and setup READMEs at 305826d. No
application code changed — the diff is four new markdown files. All four Mermaid diagrams were
rendered with mermaid-cli to confirm they parse.

• current-state.md — as-coded architecture with file:line evidence on every claim; inferences
  labelled [INFERENCE].
• target-state.md — AWS target under multi-AZ dev / multi-region prod, Postgres, ECS Fargate,
  Harness CD; 24-row mapping table with rationale / risk / effort.
• open-questions.md — 40 questions addressed to named roles (DBA, Platform, Release, Security,
  App Owner), graded B1/B2/B3 by what they block.
• migration-plan.md — 14 workstreams (WS0–WS13) with an explicit dependency graph and cutover
  entry criteria.

Blocked input

The request specified [PASTE BLESSED SERVICE LIST] as a literal placeholder. Nothing was silently
substituted: target-state.md §0 states the assumed list, and every service that is off it or
commonly excluded is tagged OFF-LIST? with an in-list fallback (Terraform → CloudFormation/CDK;
Managed Grafana/Prometheus → CloudWatch; ElastiCache → ALB stickiness). One diff pass against the
real list closes it.

Findings that changed the plan (all read from files, not assumed)

These are facts, not risks, and they are why the sequencing is gated rather than a straight lift:

• The pipeline does not build this repo. Both Jenkinsfiles check out
  LondheShubham153/Springboot-BankApp (Jenkinsfile:26, GitOps/Jenkinsfile:21) and CD pushes
  commits back to it. Four different image references exist for one app (CI publishes
  madhupdevops/bankapp; the Deployment pulls trainwithshubham/bankapp-eks:v2).
• The CD image-tag update is a silent no-op — sed edits kubernetes/bankapp-deployment.yaml,
  but the file is bankapp-deployment.yml (GitOps/Jenkinsfile:40).
• No versioned schema exists. ddl-auto=update (application.properties:9), no
  Flyway/Liquibase, and the only SQL in the repo is CREATE DATABASE. The Postgres port therefore
  depends on extracting the schema from a live DB (WS5 gates WS6).
• The engine change is cheaper than it looks: 0 native queries, 0 stored procs, 0 JdbcTemplate
  — access is 2 entities and 2 derived finders. Risk sits in schema conversion, not application SQL.
• /actuator/health does not exist — no actuator dependency in pom.xml, yet it is the health
  check in docker-compose.yml:36 and both Helm probes. ALB target groups need it.
• Sessions are in-JVM with 2 replicas and no stickiness, so scaling is already broken today.
• The DB password is committed in four places — moving it to Secrets Manager is not enough; it
  needs rotating.
• Three correctness blockers are called out as cutover-blocking and not migration work:
  non-atomic transferAmount with no @Transactional, CSRF disabled on money-moving POSTs, and a
  single hardcoded "USER" authority.

Critical path ≈ 11 Devin sessions (WS0 → WS5 → WS6 → WS7 → WS8 → WS11 → WS12 → WS13); ~17 total.
Elapsed time is dominated by the WS0 answers, credential-rotation approval, and the DR/cutover
windows — all of which should start in parallel with WS1.

Link to Devin session: https://app.devin.ai/sessions/32cf1817309847cc9500aec9e4008005
Requested by: @patrickbradley-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring