refactor(edge,iam): apply best practices to relay and Zitadel config

- edge: extract VPC/subnet/bandwidth/disk/DNS/Caddy settings into variables
- edge: add Caddyfile template with SSE-safe flush_interval -1 and security headers
- edge: add WireGuard NAT masquerade so homelab peer accepts forwarded client IPs
- edge: mark user_data sensitive and add prevent_destroy to the relay instance
- edge: validate relay_admin_cidr and Cloudflare hostnames
- edge: parameterise Cloudflare TTL/proxied and enforce proxied tunnel CNAMEs
- iam: fix PDB key to chart-supported pdb and remove unsupported extraVolumes
- iam: keep login hardened; drop unsupported login PDB

terraform/edge/templates/Caddyfile.tpl

@@ -0,0 +1,22 @@
+# Rendered by terraform/edge. Do not edit on the instance.
+#
+# Caddy terminates TLS for the .cn hostnames and forwards over the WireGuard
+# tunnel to ingress-nginx. flush_interval -1 disables response buffering so
+# Server-Sent Events reach the client chunk-by-chunk.
+{
+	email ${acme_email}
+	admin off
+}
+
+${hosts} {
+	reverse_proxy ${ingress_upstream} {
+		flush_interval -1
+	}
+
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+		X-Content-Type-Options "nosniff"
+		X-Frame-Options "DENY"
+		Referrer-Policy "strict-origin-when-cross-origin"
+	}
+}