feat: add staging ECS task definition templates - #261

Summary

• add staging API and worker ECS task-definition templates for the shared knowhere-fargate cluster
• use the approved staging task/execution role placeholders and immutable image inputs
• configure Neon staging SSL, public dashboard endpoint, CloudWatch log groups, health checks, and worker graceful-stop settings
• omit long-lived S3 access-key variables so boto3 uses ECS task-role credentials
• add a renderer that fails on missing/unresolved inputs or forbidden S3 credential variables

Scope

This PR adds reviewed deployment artifacts only. It does not register task definitions, create secrets/log groups, create services, or change AWS resources.

Verification

• JSON parsing passed for both templates
• renderer contracts: 4 passed
• Ruff passed
• Pyright passed
• git diff --check passed

The worker task definition uses requiresCompatibilities: [FARGATE]; FARGATE_SPOT is selected later by the ECS service capacity-provider strategy.