[iamharshtita]

What changed

Adds the backend/ CDK app (TypeScript) and the shared Python layer:

• DataStack: four DynamoDB tables from architecture.md section 6 (on-demand, PITR, AWS-managed encryption, RETAIN, GSIs, TTL).
• AuthStack: invite-only Cognito pool, TOTP MFA (REQUIRED by default, staffMfa context), groups cic_admin, instructor, reviewer.
• ApiStack: HTTP API under /v1, CORS allowlist, default throttling, access log without IPs, Cognito JWT authorizer, public GET /v1/health.
• lib/domains/context.ts: each API domain is its own construct and takes one line in ApiStack, so two people can add endpoints without merge conflicts.
• cic shared layer: create_response with an origin allowlist, error mapping (generic 500s), route-key dispatch, authz helpers (class membership, reviewer never sees class data), PII-redacting logger, DynamoDB helpers.
• Tests: 9 CDK assertion tests, 19 Python tests.

Nothing is deployed. Stack names start with CicCurriculum because the shared AWS account already has other stacks.

Why

Both halves of api.md need the same tables, pool, API and helpers.

How to test

cd backend && npm install && npm test && npm run test:py && npx tsc --noEmit

Versions: TypeScript is pinned to 5.9 because ts-jest does not yet allow TypeScript 7. package-lock.json is about 5,000 lines of the diff; the real change is about 900 lines.

[github-actions]

👋 Quick PR hygiene check (nothing is blocked):

• 6395 changed lines — PRs under 400 lines get reviewed and merged faster; consider splitting the next one.

Small PRs with short, clear descriptions are what judges and recruiters read. See AGENTS.md.