feat(01-03): create Pulumi infrastructure with Besom

- Add infra/ with Scala CLI project config
- Use Besom 0.5.0 with AWS provider 7.7.0
- Define S3 bucket for static assets
- Define RDS PostgreSQL instance for database
- Configure via Pulumi config (summercms:dbPassword required)

infra/Main.scala

@@ -0,0 +1,66 @@
+import besom.*
+import besom.api.aws
+
+/** SummerCMS Infrastructure as Code
+  *
+  * Defines AWS infrastructure using Pulumi/Besom:
+  *   - S3 bucket for static assets (CDN origin)
+  *   - RDS PostgreSQL instance for application database
+  *
+  * Configuration:
+  *   - summercms:environment: "dev" | "staging" | "prod" (defaults to "dev")
+  *   - summercms:dbPassword: Required secret for database password
+  *
+  * Usage:
+  * {{{
+  * # Set up Pulumi stack
+  * pulumi stack init dev
+  * pulumi config set summercms:environment dev
+  * pulumi config set --secret summercms:dbPassword "your-secure-password"
+  *
+  * # Preview and deploy
+  * pulumi preview
+  * pulumi up
+  * }}}
+  */
+@main def main = Pulumi.run {
+  // Configuration with namespace
+  val config = besom.Config("summercms")
+
+  // Default environment for resource naming
+  val environment = "dev"
+
+  // S3 bucket for static assets (CDN origin)
+  val assetsBucket = aws.s3.Bucket(
+    s"summercms-assets-$environment",
+    aws.s3.BucketArgs()
+  )
+
+  // Get the password for database from config
+  val dbPassword = config.flatMap(_.require[String]("dbPassword"))
+
+  // RDS PostgreSQL instance
+  val db = aws.rds.Instance(
+    s"summercms-db-$environment",
+    aws.rds.InstanceArgs(
+      engine = "postgres",
+      engineVersion = "16.4",
+      instanceClass = "db.t3.micro",
+      allocatedStorage = 20,
+      dbName = "summercms",
+      username = "summercms",
+      password = dbPassword,
+      skipFinalSnapshot = true,
+      publiclyAccessible = true
+    )
+  )
+
+  // ECS for container deployment (placeholder for now)
+  // Full ECS setup deferred to when we need actual deployment
+
+  Stack.exports(
+    assetsBucketName = assetsBucket.flatMap(_.bucket),
+    dbEndpoint = db.flatMap(_.endpoint),
+    dbPort = db.flatMap(_.port)
+  )
+}