feat(P4): Nova rebrand — AWS resource migration (REQ-163)

Rename all acdl-* AWS resources → nova-* across terraform (DynamoDB,
Secrets Manager, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM user/policy,
state bucket, ALB, VPC/subnet names). Lambda default table names → nova-*
(D-111). State bucket backend → nova-tfstate (-migrate-state documented).
New docs/NOVA_AWS_MIGRATION.md runbook (staged migration + rollback).
New scripts/migrate_dynamodb_data.py (scan+copy, dry-run default).
acdl-deploy- → nova-deploy- role ARN in deploy workflows. Test fixtures
updated; terraform validate + pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 4
milestone: v1.15
status: execute
---/ci---

modules/l1/alb/instance.json

@@ -11,7 +11,7 @@
       "type": "aws:elbv2:loadbalancer",
       "module": "alb@1.0.0",
       "inputs": {
-        "name": "acdl-alb",
+        "name": "nova-alb",
         "subnets": "subnet-12345",
         "security_group": "sg-12345",
         "region": "us-east-1"
@@ -27,7 +27,7 @@
       "type": "aws:elbv2:targetgroup",
       "module": "alb@1.0.0",
       "inputs": {
-        "name": "acdl-alb",
+        "name": "nova-alb",
         "port": 80,
         "protocol": "HTTP",
         "region": "us-east-1"

modules/l1/cloudfront/terraform/locals.tf

@@ -1,7 +1,7 @@
 locals {
   # OAC defaults (adapter previously hardcoded these).
-  oac_name              = "acdl-oac"
-  oac_origin_type       = "s3"
-  oac_signing_behavior  = "always"
-  oac_signing_protocol  = "sigv4"
+  oac_name             = "nova-oac"
+  oac_origin_type      = "s3"
+  oac_signing_behavior = "always"
+  oac_signing_protocol = "sigv4"
 }

modules/l1/ecs-cluster/terraform/variables.tf

@@ -1,7 +1,7 @@
 variable "name" {
   type        = string
   description = "ECS cluster name."
-  default     = "acdl-cluster"
+  default     = "nova-cluster"
 }
 
 variable "region" {

modules/l1/ecs-service/terraform/main.tf

@@ -8,15 +8,15 @@ resource "aws_ecs_task_definition" "this" {
 }
 
 resource "aws_ecs_service" "this" {
-  name            = "acdl-microservice"
+  name            = "nova-microservice"
   cluster         = var.cluster_arn
   task_definition = aws_ecs_task_definition.this.arn
   desired_count   = var.desired_count
   launch_type     = var.launch_type
 
   network_configuration {
-    subnets         = local.subnet_list
-    security_groups = local.security_groups
+    subnets          = local.subnet_list
+    security_groups  = local.security_groups
     assign_public_ip = var.launch_type == "FARGATE"
   }
 

modules/l1/iam-role/terraform/variables.tf

@@ -1,7 +1,7 @@
 variable "role_name" {
   type        = string
   description = "The IAM role name."
-  default     = "acdl-microservice-role"
+  default     = "nova-microservice-role"
 }
 
 variable "assume_role_policy" {

modules/l1/kms-key/terraform/locals.tf

@@ -1,3 +1,3 @@
 locals {
-  alias_name = "alias/acdl-ci-kms"
+  alias_name = "alias/nova-ci-kms"
 }

modules/l1/rds/terraform/main.tf

@@ -1,6 +1,6 @@
 resource "aws_db_subnet_group" "this" {
   count      = var.subnet_ids != "" ? 1 : 0
-  name       = "acdl-ci-rds-subnet-group"
+  name       = "nova-ci-rds-subnet-group"
   subnet_ids = split(",", var.subnet_ids)
 }
 

modules/l1/s3/terraform/outputs.tf

@@ -10,5 +10,5 @@ output "bucket_name" {
 
 output "bucket_regional_domain_name" {
   value       = aws_s3_bucket.this.bucket_regional_domain_name
-  description = "The bucket regional domain name (e.g. acdl-spike-bucket.s3.us-east-1.amazonaws.com)."
+  description = "The bucket regional domain name (e.g. nova-spike-bucket.s3.us-east-1.amazonaws.com)."
 }

modules/l1/uptime/terraform/main.tf

@@ -1,5 +1,5 @@
 resource "aws_ecs_task_definition" "uptime" {
-  family                   = "acdl-uptime"
+  family                   = "nova-uptime"
   cpu                      = tostring(var.cpu)
   memory                   = tostring(var.memory)
   requires_compatibilities = ["FARGATE"]
@@ -8,7 +8,7 @@ resource "aws_ecs_task_definition" "uptime" {
 }
 
 resource "aws_ecs_service" "uptime" {
-  name            = "acdl-uptime"
+  name            = "nova-uptime"
   cluster         = local.cluster_ref
   task_definition = aws_ecs_task_definition.uptime.arn
   desired_count   = var.feature_flag_enabled ? 1 : 0

modules/l1/vpc/terraform/locals.tf

@@ -1,7 +1,7 @@
 locals {
   cidr_block = var.cidr != null ? var.cidr : "10.0.0.0/16"
   az_list    = split(",", var.azs)
-  name_tag  = var.name != null ? var.name : "acdl-vpc"
+  name_tag   = var.name != null ? var.name : "nova-vpc"
 
   # Derive subnet CIDRs from the VPC CIDR
   subnet_cidrs = [

modules/l1/vpc/terraform/variables.tf

@@ -13,7 +13,7 @@ variable "azs" {
 variable "name" {
   type        = string
   description = "Name tag for the VPC and child resources."
-  default     = "acdl-vpc"
+  default     = "nova-vpc"
 }
 
 variable "region" {

modules/l1/waf/terraform/main.tf

@@ -15,7 +15,7 @@ resource "aws_wafv2_web_acl" "this" {
 
   visibility_config {
     cloudwatch_metrics_enabled = true
-    metric_name                = "acdl-waf-metrics"
+    metric_name                = "nova-waf-metrics"
     sampled_requests_enabled   = true
   }
 

modules/l1/waf/terraform/variables.tf

@@ -1,7 +1,7 @@
 variable "name" {
   type        = string
   description = "WAF Web ACL name."
-  default     = "acdl-waf"
+  default     = "nova-waf"
 }
 
 variable "scope" {