tofu: stop gitignoring the lock file and the VM inventory

The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which
hid two things that belong in version control:

- .terraform.lock.hcl pins the provider hashes. versions.tf tracks
  Telmate/proxmox 3.0.2-rc05, a release candidate, so the version
  constraint alone is not enough if that tag is ever re-published.

- terraform.tfvars held one real secret (proxmox_api_token_secret) plus the
  entire vms map — 7 VMs with their vmids, sizes and static IPs. That is
  infra definition, and it existed only on one laptop. Meanwhile the
  committed terraform.tfvars.example still advertised web1/db1.

Split at the credential boundary: the provider auth triple stays in the
gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which
is committed and auto-loaded (no -var-file needed). terraform.tfvars.example
is now credentials-only. `tofu plan` reports no changes.

State stays ignored — it carries cloud-init attributes and should not be in
git. Noted in the README that it has no remote backend, and that state
manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,13 +1,16 @@
 # OpenTofu / Terraform
 .terraform/
 .tofu/
-.terraform.lock.hcl
-.tofu.lock.hcl
 terraform.tfstate
 terraform.tfstate.*
 crash.log
-*.tfvars
-*.tfvars.json
+
+# Provider credentials only. Non-secret infra config (the vms map) is committed
+# as *.auto.tfvars, and *.lock.hcl is committed on purpose so provider hashes
+# are pinned.
+terraform.tfvars
+terraform.tfvars.json
+*secrets.auto.tfvars
 
 venv/*
 .env