infra: adds cloudfront cache invalidation for push on main

[replakcan]

Summary

adds cache invalidation for cloudfront that runs after push on main

Related Issue

Closes #16

Checklist

• The change matches the related issue scope.
• Static export compatibility is preserved.
• No API routes, Server Actions, runtime SSR, or request-time server features were added.
• AWS credentials, secrets, Terraform state, and local .tfvars files are not committed.
• Documentation was updated if behavior, architecture, or deployment changed.
• npm run check passes locally.

Screenshots

Reviewer Notes