Multi-environment support (dev/staging/prod)

[troyscott]

Description

Support multiple isolated environments from a single codebase.

Approach

• Environment name drives all resource naming
• Separate parameter files per environment
• GitHub environments with approval gates for staging/prod
• Shared Tailscale tailnet with ACL-based access control per environment

Acceptance criteria

• make up ENV=dev / make up ENV=staging creates isolated environments
• No resource naming collisions between environments
• Environment-specific parameter files
• Documented environment promotion workflow