feat: Terraform foundation for cluster & app bootstrap

Phase 1 infrastructure-as-code setup:
- Core providers (kubernetes, helm, null)
- 15 Helm repositories (grafana, minio, prometheus, etc.)
- Namespace scaffolding (15 namespaces with pod-security labels)
- Storage classes (longhorn, longhorn-kafka with prevent_destroy)
- TLS certificate bootstrap (selfsigned, CA, wildcard cert)
- Remote state backend config (local for now, S3/GCS TODO)
- Variable definitions for all secrets/OIDC clients

Tested: terraform plan passes with no changes (bootstrap infrastructure ready)
Next: Create 25 helm_release resources (Phase 2-4)

Kept helmfile intact; network/Cilium managed via helmfile (no config risk)
Co-Authored-By: Claude Haiku 4.5 <[email protected]>

terraform/bootstrap/namespaces.tf

@@ -0,0 +1,35 @@
+locals {
+  namespaces = {
+    "cert-manager"          = {}
+    "reloader"              = {}
+    "ingress-nginx"         = {}
+    "ddb"                   = {}
+    "iam"                   = {}
+    "storage"               = {}
+    "logging"               = {}
+    "monitoring"            = {}
+    "cicd"                  = {}
+    "dashboard"             = {}
+    "sqs"                   = {}
+    "temporal"              = {}
+    "story-crater-backend"  = {}
+    "llm"                   = {}
+    "dev-tools"             = {}
+  }
+}
+
+resource "kubernetes_namespace" "namespaces" {
+  for_each = local.namespaces
+
+  metadata {
+    name = each.key
+    labels = {
+      "pod-security.kubernetes.io/enforce"         = "baseline"
+      "pod-security.kubernetes.io/enforce-version" = "latest"
+      "pod-security.kubernetes.io/audit"           = "restricted"
+      "pod-security.kubernetes.io/audit-version"   = "latest"
+      "pod-security.kubernetes.io/warn"            = "restricted"
+      "pod-security.kubernetes.io/warn-version"    = "latest"
+    }
+  }
+}