security: stop tracking Talos secret backup; rotate edge WireGuard key

- remove terraform/terraform.tfvars.local.bak from the index (it carries the
  live cluster PKI: CA keys, service-account key, secretbox secret)
- ignore terraform/*.bak and terraform/edge/.secrets/
- generate a fresh WireGuard relay keypair into the git-ignored local tfvars;
  the committed example now documents rotation instead of holding key material

.gitignore

@@ -85,3 +85,7 @@ scripts/iam/*.py
 # Runtime credential export from the old Authentik provisioning run. Holds live
 # M2M tokens; never commit it.
 /authentik-m2m-tokens.env
+
+# Never commit backup copies of plaintext tfvars (they carry cluster PKI)
+terraform/*.bak
+terraform/edge/.secrets/