Set up ministack for local AWS emulation (NH-286)

Status: DEFERRED / capture-only — filed so it isn't forgotten. Not scheduled yet.
Jira: NH-286

Goal

Run AWS services locally via ministack so I can iterate on the Pulumi / edge / backend stack without hitting real AWS. Protects against a runaway-cost mistake and removes the "free-tier clock" anxiety.

Suggested trigger to start

When the Cognito admin-gate work begins — the first time we have real runtime AWS surface worth mocking. Before then there is little to mock (see findings).

Background / findings (research 2026-07-18)

• LocalStack's free Community image is gone — sunset 2026-03-23, now requires an auth token. So "LocalStack is too limited" is now also "LocalStack isn't free." (A non-commercial Hobby tier exists but needs an account.)
• ministack — https://ministack.org · https://github.com/ministackorg/ministack — MIT, ~3.8k stars, 60+ services on a single port 4566, docker run -p 4566:4566 ministackorg/ministack, no signup / no telemetry. Drop-in endpoint override for AWS SDK / CLI / Pulumi / Terraform.
• The app makes ZERO @aws-sdk runtime calls today. The Lambda talks to Neon over HTTPS (not AWS). So the current AWS surface is deployment-time only — Pulumi creating Lambda + CloudFront + S3 + IAM.
• The stack is ~$0 on AWS's perpetual always-free tiers (Lambda 1M req/mo, CloudFront 1 TB out, DynamoDB 25 GB, Cognito 50k MAU). The 6-month credit clock is not the real cost risk — a mistake is.

Two justifications that survive

1. Credential-free CI — NH-206 pulled pulumi preview off PRs (no AWS creds on PRs). ministack needs no credentials, so it could restore a real infra test on PRs.
2. Cognito soon — the admin gate brings real runtime AWS surface; ministack supports Cognito User Pools + Identity Pools.

Scope caveat (important)

ministack's CloudFront is metadata-only (CloudFront Functions are API stubs — no edge execution). CloudFront + OAC is the core of ARCH-EDGE-1, so the edge must stay real-AWS-verified-on-deploy. Do NOT try to validate two-origin routing / OAC / SigV4 against ministack — it would go green while meaning nothing.

Proposed mock scope: Lambda + S3 + IAM (+ Cognito when it lands). Not CloudFront.

Open decisions when un-parking

• Scope: Lambda+S3+IAM only, vs add a local edge substitute (Caddy/nginx) to mirror the two-origin routing shape locally.
• CI: local dev loop only, vs also a credential-free ministack infra job in CI (restores the NH-206 safety net).

Acceptance (when built)

• docker compose (or docker run) brings ministack up on :4566.
• Documented endpoint-override config for Pulumi / AWS SDK pointing at ministack.
• At least one local flow verified against ministack (e.g. S3 upload + Lambda invoke).
• Doc note recording the CloudFront boundary (why the edge is NOT mocked).

_{Tracked in Jira NH-286. Created as a reminder so ministack setup isn't forgotten.}

Start with the proposed mock scope and the two open decisions: Lambda, S3, IAM, and later Cognito, while keeping CloudFront out of the mock. Review the docker compose or docker run setup and endpoint-override configuration described in the issue. Done means ministack runs on :4566, one local flow is verified, and the CloudFront boundary is documented.