feat: Terraform foundation for cluster & app bootstrap

Phase 1 infrastructure-as-code setup:
- Core providers (kubernetes, helm, null)
- 15 Helm repositories (grafana, minio, prometheus, etc.)
- Namespace scaffolding (15 namespaces with pod-security labels)
- Storage classes (longhorn, longhorn-kafka with prevent_destroy)
- TLS certificate bootstrap (selfsigned, CA, wildcard cert)
- Remote state backend config (local for now, S3/GCS TODO)
- Variable definitions for all secrets/OIDC clients

Tested: terraform plan passes with no changes (bootstrap infrastructure ready)
Next: Create 25 helm_release resources (Phase 2-4)

Kept helmfile intact; network/Cilium managed via helmfile (no config risk)
Co-Authored-By: Claude Haiku 4.5 <[email protected]>

terraform/state.tf

@@ -0,0 +1,17 @@
+terraform {
+  backend "local" {
+    path = "terraform.tfstate"
+  }
+}
+
+# TODO: Configure remote state (S3, GCS, or Terraform Cloud)
+# Uncomment when ready:
+# terraform {
+#   backend "s3" {
+#     bucket         = "homelab-terraform-state"
+#     key            = "prod/terraform.tfstate"
+#     region         = "us-east-1"
+#     encrypt        = true
+#     dynamodb_table = "terraform-lock"
+#   }
+# }