fix(iam,edge): freeze first-boot and wire the WireGuard CIDR variable

Zitadel first boot completed on 2026-10-26, so set FirstInstance.Skip: true and
initJob.enabled: false. Without Skip, every sync re-runs machinekeyWriter and
silently rotates the iam-admin key that terraform/zitadel authenticates with.

Also wire wireguard_allowed_cidr into the WireGuard security-group rule; the
variable was declared but the rule still used relay_admin_cidr, which blocks
the homelab peer unless its egress address happens to match the operator CIDR.

terraform/edge/tencent.tf

@@ -56,8 +56,12 @@ resource "tencentcloud_security_group_rule" "wireguard" {
   type              = "ingress"
   ip_protocol       = "udp"
   port_range        = tostring(var.wireguard_port)
-  cidr_ip           = var.relay_admin_cidr
-  policy            = "accept"
+  # The homelab dials outbound and has no static public address, so this is
+  # 0.0.0.0/0 by default. WireGuard authenticates every packet by public key,
+  # and an unauthenticated packet is dropped before it reaches the tunnel.
+  # Narrow this to the homelab egress CIDR when that address is stable.
+  cidr_ip = var.wireguard_allowed_cidr
+  policy  = "accept"
 }
 
 # cloud-init: WireGuard listener, forwarding sysctls, and Caddy for TLS.