fix(cdk): allow Beanstalk VPC discovery

infra/cdk/README.md

@@ -210,6 +210,12 @@ it intentionally does not copy the managed
 `s3:Put*`, or `s3:Delete*` grants. Any later denial must be evaluated and
 granted independently.
 
+The July 30 deployment of backend PR #41 then reached `UpdateEnvironment` and
+failed on `ec2:DescribeVpcs`. Elastic Beanstalk performs this read-only network
+discovery using the initiating role, so the CDK policy includes that action
+alongside the existing EC2 describe permissions. It remains resource `*`
+because `DescribeVpcs` does not support resource-level permissions.
+
 The pinned deployment action can return success after Elastic Beanstalk emits a
 fatal deployment event. The following workflow step therefore verifies that
 the exact immutable version label is active and healthy before smoke testing.

infra/cdk/deploy-dev-stack.ts

@@ -108,6 +108,7 @@ export class DeployDevStack extends cdk.Stack {
           'ec2:DescribeAvailabilityZones',
           'ec2:DescribeImages',
           'ec2:DescribeSubnets',
+          'ec2:DescribeVpcs',
         ],
         resources: ['*'],
       }),