Add oauth proxy and supporting ecr infra

terraform/iam.tf

@@ -57,3 +57,25 @@ resource "aws_iam_role_policy" "node_secrets_manager" {
   })
 }
 
+
+# ECR pull access for node (to pull custom images like mcp-auth-proxy)
+resource "aws_iam_role_policy" "node_ecr" {
+  name = "ecr-pull"
+  role = aws_iam_role.node.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = [
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:BatchGetImage",
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:GetAuthorizationToken"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}