fix: prevent orphaned ALB target groups and improve Jupyter URL handling

[wdvr]

Summary

• Fix ALB target group leak that caused 100 TG limit to be hit
• Skip ALB setup when Jupyter is disabled (port=0)
• Clean up orphaned target groups when listener rule creation fails
• Add periodic cleanup of orphaned target groups in expiry Lambda
• Use IP:port fallback instead of broken domain:port URL

Root Cause Analysis

ALB target groups were accumulating because:

1. Target groups created BEFORE listener rule
2. Listener rule creation failed (100 TG limit hit)
3. Target group never cleaned up (no mapping stored)
4. Some reservations had jupyter_port=0, causing "Invalid port" errors

CloudWatch Evidence

[ERROR] Invalid value for parameter Port, value: 0, valid min value: 1
[ERROR] TooManyUniqueTargetGroupsPerLoadBalancer: 100 limit reached

Test plan

• Deploy Lambda changes via tf apply
• Create new reservation with Jupyter enabled - verify HTTPS URL
• Create reservation without Jupyter - verify no TG created
• Wait for expiry Lambda to run - check orphaned TG cleanup logs
• Verify no new orphaned TGs accumulate over time

🤖 Generated with Claude Code