Review: Update terraform refs: westside-app to westside-landing

Verdict: APPROVED

Template Completeness

• [x] Type — Feature
• [x] Lineage — Sub-ticket of forgejo_admin/westside-app#109, depends on sub-ticket 1
• [x] Repo — forgejo_admin/pal-e-services
• [x] User Story — superadmin wants terraform refs updated to match renamed repo
• [x] Context — explains decomposition from #109, Harbor and Keycloak client_id exclusions documented
• [x] File Targets — 3 files with specific lines, plus explicit "do NOT touch" list
• [x] Acceptance Criteria — 6 criteria, all verifiable
• [x] Test Expectations — tofu fmt, validate, plan commands specified
• [x] Constraints — tofu lock=false, dependency on sub-ticket 1, Keycloak client_id exclusion
• [x] Checklist — PR, plan output, tests, no unrelated changes
• [x] Related — parent ticket, all 4 sub-tickets, project page

Traceability

• [x] story:WS-S26 — westside landing site story, present on board item #588
• [x] arch:landing-site — landing site architecture component, present on board item #588
• [x] Forgejo issue — forgejo_admin/pal-e-services#41, open

File Targets

• [x] terraform/k3s.tfvars line 41 — verified: westside-app = { exists in keycloak_clients block
• [x] terraform/k3s.tfvars line 43 — verified: client_id = "westside-app" exists, correctly excluded from scope
• [ ] terraform/k3s.tfvars "line 130" — MINOR: issue says line 130 but forgejo_repo = "forgejo_admin/westside-app" is actually at line 141 (inside westsidekingsandqueens service block). Content is correct, line number is off by 11. Not a blocker — agent will find it by content match.
• [x] terraform/keycloak-import.sh line 13 — verified: import command references westside-app map key
• [x] terraform/keycloak-import.sh lines 28-29 — verified: protocol mapper echo and import reference westside-app
• [x] terraform/services.tf line 173 — verified: comment references westside-app-funnel
• [x] Harbor image_repo — verified unchanged: westsidekingsandqueens/app derives from hostname prefix, not repo name

Repo Placement

Dependencies

• [x] Sub-ticket 1 (Forgejo repo rename, board item #587) — satisfied, column: done
• [x] Sub-ticket 3 (#589, pal-e-deployments overlays) — independent, in backlog. No dependency.
• [x] Sub-ticket 4 (#590, pal-e-platform blackbox probe) — independent, in backlog. No dependency.

Acceptance Criteria

• Criteria 1-4: grep-verifiable string replacements in known files
• Criterion 5: tofu plan -lock=false with explicit run command (cd terraform && tofu plan -lock=false -var-file=k3s.tfvars)
• Criterion 6: grep-verifiable — image_repo prefix is westsidekingsandqueens, unchanged

Blast Radius

• SERVICE_ONBOARDING.md line 127 references westside-app as a Keycloak client_id example — this is documentation about the client_id (which stays unchanged), so no update needed.
• The keycloak_clients map key rename from westside-app to westside-landing will change terraform resource addresses (e.g., keycloak_openid_client.this["westside-app"] becomes keycloak_openid_client.this["westside-landing"]). This will show as destroy+recreate in tofu plan unless a moved block is added. The issue's AC says "tofu plan shows expected changes (key rename + forgejo_repo)" which implies awareness of this. Agent should verify plan output carefully.
• No other files in pal-e-services reference westside-app outside the targeted files.
• Rollback is straightforward — revert the string replacements.

Decomposition Assessment

Recommendation

• [BODY] Minor: fix line number reference — "line 130" should be "line 141" for forgejo_repo in k3s.tfvars. Not a blocker; agent will match by content.