security: stop tracking Talos secret backup; rotate edge WireGuard key

- remove terraform/terraform.tfvars.local.bak from the index (it carries the
  live cluster PKI: CA keys, service-account key, secretbox secret)
- ignore terraform/*.bak and terraform/edge/.secrets/
- generate a fresh WireGuard relay keypair into the git-ignored local tfvars;
  the committed example now documents rotation instead of holding key material

terraform/edge/variables.tf

@@ -134,6 +134,12 @@ variable "wireguard_port" {
   default     = 51820
 }
 
+variable "wireguard_allowed_cidr" {
+  description = "CIDR allowed to reach the WireGuard UDP port. The homelab dials outbound, so this is often 0.0.0.0/0; WireGuard authenticates by key. Restrict it to the homelab egress CIDR when that address is static."
+  type        = string
+  default     = "0.0.0.0/0"
+}
+
 variable "wireguard_relay_private_key" {
   description = "WireGuard private key of the relay side. Generate with `wg genkey`; pass via TF_VAR_wireguard_relay_private_key."
   type        = string