feat: Terraform foundation for cluster & app bootstrap

Phase 1 infrastructure-as-code setup:
- Core providers (kubernetes, helm, null)
- 15 Helm repositories (grafana, minio, prometheus, etc.)
- Namespace scaffolding (15 namespaces with pod-security labels)
- Storage classes (longhorn, longhorn-kafka with prevent_destroy)
- TLS certificate bootstrap (selfsigned, CA, wildcard cert)
- Remote state backend config (local for now, S3/GCS TODO)
- Variable definitions for all secrets/OIDC clients

Tested: terraform plan passes with no changes (bootstrap infrastructure ready)
Next: Create 25 helm_release resources (Phase 2-4)

Kept helmfile intact; network/Cilium managed via helmfile (no config risk)
Co-Authored-By: Claude Haiku 4.5 <[email protected]>

terraform/bootstrap/storage-classes.tf

@@ -0,0 +1,40 @@
+resource "kubernetes_storage_class" "longhorn" {
+  metadata {
+    name = "longhorn"
+    annotations = {
+      "storageclass.kubernetes.io/is-default-class" = "true"
+    }
+  }
+  provisioner            = "driver.longhorn.io"
+  reclaim_policy         = "Delete"
+  allow_volume_expansion = true
+
+  parameters = {
+    numberOfReplicas    = "2"
+    staleReplicaTimeout = "30"
+    fromBackup          = ""
+    fstype              = "ext4"
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "kubernetes_storage_class" "longhorn_kafka" {
+  metadata {
+    name = "longhorn-kafka"
+  }
+  provisioner            = "driver.longhorn.io"
+  reclaim_policy         = "Delete"
+  allow_volume_expansion = true
+
+  parameters = {
+    numberOfReplicas    = "3"
+    staleReplicaTimeout = "30"
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}