fix(infra): address PR review feedback on tf modules

Deployer role:
- Add servicediscovery actions; module always creates Cloud Map namespace
  and service so the policy must grant CreatePrivateDnsNamespace etc.
- Make Route53 + ACM permissions unconditional. The server module always
  issues an ACM cert and writes Route53 records (no CloudFront default-cert
  path exists), so gating these on route53_zone_ids was broken. Split
  Route53 into hosted-zone management (always) plus record-set mutation
  (scoped to caller-supplied zones, falls back to *).
- Remove unused cloudfront:* statement; no CloudFront resources in module.
- Replace acm:* wildcard with explicit cert-management action set.

Server module:
- qdrant_image_tag is now nullable with default null and validated against
  use_external_qdrant, so external-qdrant callers can omit it instead of
  passing a sentinel "unused" value.
- task_role_arn and efs_id outputs marked sensitive; qdrant_dns_name returns
  null when use_external_qdrant = true.
- ALB SG now has matching IPv6 egress rule (was v4-only).
- nextcloud_url validates the https:// scheme.
- random_pet.subdomain keeper includes zone_name so a zone migration that
  preserves zone_id still triggers regeneration.
- Pin required_version >= 1.9 on both modules.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

infra/terraform/nextcloud-mcp-server/outputs.tf

@@ -22,7 +22,9 @@ output "ecs_service_name" {
 }
 
 output "efs_id" {
-  value = aws_efs_file_system.this.id
+  description = "EFS file-system ID. Marked sensitive — surfacing it in CI logs invites enumeration of mount targets."
+  value       = aws_efs_file_system.this.id
+  sensitive   = true
 }
 
 output "log_group_name" {
@@ -30,7 +32,9 @@ output "log_group_name" {
 }
 
 output "task_role_arn" {
-  value = aws_iam_role.task.arn
+  description = "Task role ARN. Marked sensitive — knowing the ARN is the first step to abusing it via SSRF/role-confusion."
+  value       = aws_iam_role.task.arn
+  sensitive   = true
 }
 
 output "alb_dns_name" {
@@ -43,6 +47,6 @@ output "qdrant_service_name" {
 }
 
 output "qdrant_dns_name" {
-  description = "Internal DNS name where mcp-server reaches qdrant"
-  value       = "qdrant.${aws_service_discovery_private_dns_namespace.this.name}"
+  description = "Internal DNS name where mcp-server reaches qdrant (null when use_external_qdrant = true)."
+  value       = var.use_external_qdrant ? null : "qdrant.${aws_service_discovery_private_dns_namespace.this.name}"
 }