feat(docs): add ephemeral per-PR documentation previews

[nx-plugin-for-aws]

Reason for this change

Reviewers currently have to build the documentation site locally to see how doc changes render. This adds an automatic, isolated preview of the docs site for every pull request that touches docs/**, with the link commented back on the PR.

Description of changes

Adds a per-PR documentation preview system:

• pr-docs-preview.yml (pull_request) — builds the docs site with DOCS_BASE_PATH=/pr-<n> so all assets and links resolve under the PR's preview subpath, and uploads the result as an artifact.
• pr-docs-preview-deploy.yml (workflow_run) — downloads the artifact, syncs it to an S3 prefix (pr-<n>/), invalidates CloudFront, and posts/updates a comment with the preview link. The deploy job uses a docs-preview environment with required reviewers, so a maintainer approves each preview deployment before it is published.
• pr-docs-preview-cleanup.yml (pull_request_target on close) — removes the PR's preview prefix from S3.
• docs-preview-infra/ — a standalone CDK app (deployed manually by maintainers, separate from the Nx workspace) that provisions a private S3 bucket, a CloudFront distribution with Origin Access Control and a URL-rewrite function for Astro's directory-style routes, and a GitHub OIDC deploy role scoped to this repo's default branch.

Each PR's preview is isolated under its own pr-<n>/ key prefix on a single shared distribution. Previews are ephemeral — removed when the PR closes, with an S3 lifecycle rule expiring any stragglers. Production docs on GitHub Pages are unaffected; this is purely additive.

One-time maintainer setup is documented in docs-preview-infra/README.md: deploy the CDK app, set the four repository secrets from the stack outputs, and create the docs-preview environment with required reviewers.

Description of how you validated changes

• Verified the docs build with a PR-scoped base path (DOCS_BASE_PATH=/pr-786 nx run docs:build) produces output with the correct subpath baked into asset URLs and links, and a root redirect to /pr-<n>/en.
• Validated all three workflow YAML files parse correctly.
• Confirmed the CDK app synthesizes and produces the expected S3 bucket, CloudFront distribution + function + OAC, and an OIDC role with a default-branch-scoped trust policy and least-privilege permissions.

Issue # (if applicable)

N/A

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.22%. Comparing base (283bb93) to head (6f317c1).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #789   +/-   ##
=======================================
  Coverage   87.22%   87.22%           
=======================================
  Files         140      140           
  Lines        4987     4987           
  Branches     1164     1164           
=======================================
  Hits         4350     4350           
  Misses        338      338           
  Partials      299      299           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.