security: implement group 3 - network security foundation

[rshade]

Network Security Foundation (HIGH PRIORITY)

Reference: security-groups/group-3-network-security.md

Tasks

1. Explicit subnet control — switch from autoCreateSubnetworks to explicit subnets
2. Deny-all default firewall rules with specific allow rules for GKE, HTTPS, and internal traffic
3. VPC Flow Logs — enable for network monitoring and security analysis
4. Private Service Connect — route GCP API traffic through private endpoints
5. Cloud Armor — deploy with configurable geo-blocking rules (driven by Pulumi config, not hardcoded country codes) and rate limiting

Important Notes

• Cloud Armor geo-blocking policy must be driven by cloudArmor:blockedRegions Pulumi config — do not hardcode country codes
• Firewall rules need careful testing to avoid breaking GKE cluster communication

Acceptance Criteria

• Explicit firewall rules with deny-all default
• VPC flow logs enabled
• Private service connect endpoints functional
• Cloud Armor deployed with configurable rules
• All application connectivity preserved