refactor(terraform): decouple EC2 instances into own Terraform root — Layer 2

[bhumi46]

Part of #273

What

Extract EC2 instance creation (nginx node + all K8s nodes) out of aws-resource-creation into a standalone Terraform root.

Why

Currently EC2, EBS, Security Groups, and Route53 all live in aws-resource-creation. Scaling nodes or changing instance type requires a plan that also evaluates DNS and SG state.

Acceptance Criteria

• ec2 component is a standalone Terraform root under terraform/implementations/aws/ec2/
• Reads security group IDs via data "aws_security_group" by tag (no state coupling with Layer 1)
• Node count, instance type, and AMI are inputs to the component
• State is isolated — EC2 changes do not touch DNS or SG state