Add OpenGraph card previews for Mattermost link unfurling

[raheelkhan]

Summary

Enables Mattermost to show rich link previews when someone posts a Fizzy card URL. Since Fizzy requires authentication, Mattermost's server-side link fetcher was hitting the login page and getting no OG meta tags.

Solution: For unauthenticated requests from trusted VPC IPs, CardsController#show serves a minimal HTML page with just OpenGraph meta tags (title, description, image). Authenticated users and requests from outside the VPC get the normal behavior.

Changes

• app/controllers/concerns/opengraph_preview.rb — Concern that checks request.remote_ip against CIDRs in OPENGRAPH_TRUSTED_CIDRS env var
• app/controllers/cards_controller.rb — show action skips auth for trusted IPs, serves OG-only HTML response
• app/views/cards/opengraph.html.erb — Minimal HTML with og:title, og:description, og:image, og:url meta tags (reuses existing card_social_tags helper)
• infra/lib/constructs/service.ts — Injects OPENGRAPH_TRUSTED_CIDRS from vpc.vpcCidrBlock (resolves to 10.1.0.0/16)
• infra/cdk.context.json — Added Production VPC context cache
• justfile + infra/scripts/ — CDK wrapper scripts and justfile matching nexus infra patterns

How it works

1. Someone posts a Fizzy card URL in Mattermost (e.g. https://fizzy.zarhq.dev/0000001/cards/316)
2. Mattermost server (same VPC) fetches the URL to extract link preview metadata
3. Fizzy checks request.remote_ip against OPENGRAPH_TRUSTED_CIDRS
4. Trusted IP + unauthenticated = serve minimal HTML with OG meta tags
5. Mattermost renders the card preview with title, description, and image

Security

• Only IPs within the VPC CIDR can access OG tags without authentication
• External/untrusted requests still get the normal login redirect
• No sensitive card data exposed — only title, description excerpt (200 chars), and image URL

Test plan

• Deploy to DevOps and verify OPENGRAPH_TRUSTED_CIDRS is set to 10.1.0.0/16 in task definition
• From within the VPC, curl a card URL without auth and confirm OG meta tags are returned
• From outside the VPC, confirm the same URL redirects to login
• Post a Fizzy card URL in Mattermost and verify the link preview renders
• Confirm authenticated users still see the full card view normally

🤖 Generated with Claude Code

[raheelkhan]

Unnecessary complex. Closing this. Better to have the plugin talks to Fizzy with Bearer Token.