feat: Terraform Foundation - AWS Landing Zone

Enterprise-grade multi-tenant AWS cloud foundation.

Modules:
- GitHub OIDC for keyless CI/CD authentication
- IAM account settings and security baseline
- AWS Config Rules for compliance
- ABAC (Attribute-Based Access Control)
- SCPs (Service Control Policies)

Features:
- Multi-account architecture
- Cost optimization patterns
- Security best practices
- Comprehensive documentation

Tech: Terraform, AWS Organizations, IAM Identity Center

terraform/modules/app-account/README.md

@@ -0,0 +1,36 @@
+# app-account
+
+Terraform module for AWS landing zone pattern.
+
+Provision new application/workload AWS accounts with account vending pattern.
+
+## Planned Features
+
+- [ ] Create account via AWS Organizations
+- [ ] Place in appropriate OU
+- [ ] Apply account baseline module
+- [ ] Configure VPC (shared or dedicated)
+- [ ] Create cross-account IAM roles
+- [ ] Set up budget alerts
+- [ ] Apply standard tags
+
+## Planned Usage
+
+```hcl
+module "app_account" {
+  source = "../modules/app-account"
+  
+  account_name  = "myapp-prod"
+  account_email = "aws+myapp-prod@company.com"
+  environment   = "prod"
+  owner         = "platform-team"
+  
+  vpc_config = {
+    mode = "shared"  # Use shared VPC from network account
+  }
+  
+  budget_limit = 500
+  
+  tags = local.tags
+}
+```