feat(terraform): enable S3 remote state backend (MinIO)

Migrate terraform state from local file to MinIO S3 bucket (terraform-state).
Backend config: https://minio-api.riotpiao.homelab.com (external endpoint).
State now persisted remotely, shared across team, safe for cluster rebuild.

Also added terraform-state bucket to MinIO managed buckets.

terraform/minio.tf

@@ -66,6 +66,7 @@ resource "helm_release" "minio" {
 
       # Buckets auto-created on install (all-in-one, no post-hook needed)
       buckets = [
+        { name = "terraform-state", policy = "none", purge = false },
         { name = "vault", policy = "none", purge = false },
         { name = "riotpiao-models", policy = "none", purge = false },
         { name = "loki-chunks", policy = "none", purge = false },

terraform/state.tf

@@ -1,20 +1,13 @@
-# Temporarily disabled S3 (MinIO unreachable)
-# terraform {
-#   backend "s3" {
-#     bucket                      = "terraform-state"
-#     key                         = "homelab/terraform.tfstate"
-#     region                      = "us-east-1"
-#     endpoint                    = "https://minio-api.riotpiao.homelab.com"
-#     skip_credentials_validation = true
-#     skip_requesting_account_id  = true
-#     skip_region_validation      = true
-#     use_path_style              = true
-#   }
-# }
-
-# Local backend fallback (active during MinIO outage)
+# S3 backend (MinIO remote state)
 terraform {
-  backend "local" {
-    path = "terraform.tfstate"
+  backend "s3" {
+    bucket                      = "terraform-state"
+    key                         = "homelab/terraform.tfstate"
+    region                      = "us-east-1"
+    endpoint                    = "https://minio-api.riotpiao.homelab.com"
+    skip_credentials_validation = true
+    skip_requesting_account_id  = true
+    skip_region_validation      = true
+    use_path_style              = true
   }
 }