cibello(terraform): add lifecycle ignore_changes for placeholder SSM secrets

Prevent Terraform from overwriting externally-managed secret values

infrastructure/terraform/secrets.tf

@@ -45,35 +45,59 @@ resource "aws_ssm_parameter" "entitlement_signing" {
 resource "aws_ssm_parameter" "gemini_api_key" {
   name  = "/cibello/prod/gemini-api-key"
   type  = "SecureString"
-  value = ""
+  value = "PLACEHOLDER_FILL_MANUALLY"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "aamos_api_key" {
   name  = "/cibello/prod/aamos-api-key"
   type  = "SecureString"
-  value = ""
+  value = "PLACEHOLDER_FILL_MANUALLY"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "apple_private_key" {
   name  = "/cibello/prod/apple-private-key"
   type  = "SecureString"
-  value = ""
+  value = "PHASE7_PLACEHOLDER"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "google_service_account_json" {
   name  = "/cibello/prod/google-service-account-json"
   type  = "SecureString"
-  value = ""
+  value = "PHASE7_PLACEHOLDER"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "smtp_pass" {
   name  = "/cibello/prod/smtp-pass"
   type  = "SecureString"
-  value = ""
+  value = "PLACEHOLDER_FILL_FROM_MAILU"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }
 
 resource "aws_ssm_parameter" "eoc_push_token" {
   name  = "/cibello/prod/eoc-push-token"
   type  = "SecureString"
-  value = ""
+  value = "PLACEHOLDER_FILL_FROM_SERVER2"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
 }