feat(edge): Terraform for the China-facing relay and Cloudflare DNS

Adds terraform/edge, a root module with two providers:

- Cloudflare 5.28.1: CNAMEs to the existing tunnel, plus an opt-in resource that
  can take the tunnel ingress list over when manage_tunnel_config is true. It is
  off by default because that resource REPLACES the whole list, and the tunnel is
  remotely managed from the dashboard today.
- Tencent Cloud 1.83.38: VPC, subnet, security group with three rules, key pair,
  one CVM relay with cloud-init (WireGuard listener, forwarding sysctls, Caddy),
  and DNSPod A records for the .cn hostnames.

The design keeps the homelab inbound-free: the relay terminates TLS in China and
forwards over a WireGuard tunnel the cluster dials outbound. Cloudflare keeps
serving every existing hostname untouched.

Verified: terraform init succeeds for both providers, fmt clean, validate
reports 0 errors, and plan resolves to 10 creates with placeholder variables.
Provider-side name validation caught a real bug during that run: key pair and
security group names allow only letters, digits and underscore, so the derived
names use underscores.

Not applied. Credentials come from CLOUDFLARE_API_TOKEN,
TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY; the WireGuard private key is
TF_VAR only. State is local and git-ignored like terraform/zitadel.

Blocked on facts this module cannot invent: the real .cn domain, whether it has
an ICP filing, the CVM image ID, the operator CIDR, and the homelab WireGuard
public key.

terraform/edge/terraform.tfvars.example

@@ -0,0 +1,38 @@
+# Copy to terraform.tfvars.local (git-ignored) and fill in.
+# Secrets never belong in a committed file: pass them as environment variables
+# instead — TF_VAR_wireguard_relay_private_key, CLOUDFLARE_API_TOKEN,
+# TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY.
+
+# ── Cloudflare (existing zone) ───────────────────────────────────────────────
+cloudflare_zone_id = "REPLACE_WITH_ZONE_ID"
+tunnel_id          = "REPLACE_WITH_TUNNEL_UUID"
+
+# Adopt existing records with `terraform import` before the first apply, or the
+# create call collides with the hand-made record of the same name.
+cloudflare_tunnel_hostnames = ["paperless", "img", "poimen"]
+
+# Leave false until the tunnel config import is understood. True makes
+# Terraform replace the entire ingress list with tunnel_ingress.
+manage_tunnel_config = false
+tunnel_ingress       = {}
+
+# ── China edge (Tencent Cloud) ───────────────────────────────────────────────
+china_domain   = "REPLACE.example.cn"
+china_hostnames = ["paperless", "img"]
+
+# Mainland regions require an ICP filing for the domain. Use ap-hongkong or
+# ap-singapore when no filing exists.
+tencent_region            = "ap-guangzhou"
+tencent_availability_zone = "ap-guangzhou-6"
+relay_instance_type       = "S5.SMALL2"
+relay_image_id            = "REPLACE_WITH_IMAGE_ID"
+relay_ssh_public_key      = "ssh-ed25519 AAAA... operator@laptop"
+relay_admin_cidr          = "REPLACE_WITH_OPERATOR_CIDR"
+
+# ── WireGuard between the relay and the cluster ──────────────────────────────
+# The relay private key comes from `wg genkey`. Keep it in the environment, or
+# in a SOPS file mounted for the run. It is not written by this module.
+wireguard_port                 = 51820
+wireguard_homelab_public_key   = "REPLACE_WITH_HOMELAB_WG_PUBKEY"
+wireguard_relay_address        = "10.88.0.1/24"
+wireguard_homelab_address      = "10.88.0.2/24"