Enable 4-day automated backups on incubator-prod-database

[ale210]

Sets backup_retention_period to 4 on incubator-prod-database, which currently runs with no automated backups and no snapshots.

Closes #149

Draft on purpose — do not merge until an outage window is scheduled

Merging this PR is the deploy. terraform-apply.yaml runs terraform apply with auto_approve: true on every push to main touching a .tf file, and the instance has apply_immediately = true.

Changing backup retention from 0 to a non-zero value restarts the RDS instance. This is not a zero-downtime change, and all six projects share this one instance (vrms, civic-tech-index, civic-tech-jobs, home-unite-us, people-depot, access-the-data). Mark ready for review only once the window is booked and announced.

Before merging, check the plan

The terraform-plan output must show an in-place update to aws_db_instance.default and nothing else. A plan proposing to replace this resource must not be merged — skip_final_snapshot = true and deletion_protection = false mean nothing would stop a destroy.

Cost

No cost increase. The database holds ~5.8 GiB against a free backup-storage allowance equal to its 100 GiB of allocated storage, so projected backup storage (~13 GiB including the planned manual snapshot) stays well inside the free tier.

After merging

Post-merge steps are on #149: verify retention reads 4, take the incubator-prod-database-pre-pg15 manual snapshot, confirm it reaches available, and check the ECS services in incubator-prod reconnected.

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

Plan: 0 to add, 1 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # aws_db_instance.default will be updated in-place
!~  resource "aws_db_instance" "default" {
!~      backup_retention_period               = 0 -> 4
        id                                    = "db-WEFHC5MZIA5NX5PBTQZPC2STZQ"
        tags                                  = {
            "Name"              = "incubator-prod-database"
            "terraform_managed" = "true"
        }
#        (72 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

✅ Plan applied in Terraform apply (OIDC) #59