feat(k8s): unify AWS (EKS) and on-premise Kubernetes deployment under bin/k8s

### Feature Summary

Today `bin/k8s` on `main` ships a single Helm chart that targets a local / on-premise Kubernetes cluster only. The same chart is used for our AWS (EKS) deployment, but everything underneath it — the EKS cluster, S3 bucket (LakeFS backend), IAM/IRSA roles, Elastic IP, DNS, node pools, cert-manager — is created by hand and lives nowhere in the repo. None of that substrate is captured as code, so standing up Texera on a fresh AWS account is an undocumented, manual prerequisite checklist that drifts and is hard to reproduce.

**Goal:** unify the local and AWS deployment stories so there is one documented, reproducible path from "empty cluster (or empty AWS account)" to "running Texera," while keeping the Helm chart itself cloud-agnostic and the on-prem/local install unchanged as the default.

This issue tracks the big picture; it follows the design discussion in #5641. **Update (2026-07): the AWS substrate will be provisioned with Terraform** (superseding the earlier eksctl lean) — reproducible in-repo Terraform modules for the EKS cluster and the non-cluster substrate (S3 bucket + CORS, IAM/IRSA, Elastic IP, DNS) — while the Helm chart itself stays cloud-agnostic and portable.

### Proposed Solution or Design

Land the change as a series of small, independently reviewable, **non-breaking** PRs (on-prem stays the default throughout). Each becomes a sub-task of this issue:

- [x] **Refactor: reorganize Helm templates into `common`/`aws`/`onprem` + per-component subfolders** — establishes the structure later steps build on (no behavior change). ✅ #5757
- [x] **Make object storage pluggable** — optional in-cluster MinIO + external S3 for the app, LakeFS, and Lakekeeper. ✅ #5932 (app tier), #6295 (LakeFS & Lakekeeper)
- [ ] **Core-services node placement + autoscaler safety** — `nodeSelector`/`tolerations` for singletons + `do-not-disrupt` annotations (empty/no-op by default).
- [ ] **AWS load-balancer front door** — extend `gatewayConfig` with an `EnvoyProxy` carrying AWS NLB/EIP/AZ annotations (renders nothing off-AWS).
- [ ] **Warm computing-unit pool** — warm placeholder to mitigate autoscaler cold-start latency on CU launches.
- [ ] **Terraform provisioning modules + util manifests + AWS runbook** — Terraform modules for the EKS cluster and the AWS substrate (S3 bucket + CORS, IAM/IRSA, EIP, DNS), EBS StorageClass / cert-manager util manifests, and an end-to-end provisioning doc.

Each step is verified to keep the default (on-prem) render unchanged and to render the AWS-specific resources only under an opt-in AWS values overlay.

### Affected Area

Deployment / Infrastructure