tofu: stop gitignoring the lock file and the VM inventory

The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which
hid two things that belong in version control:

- .terraform.lock.hcl pins the provider hashes. versions.tf tracks
  Telmate/proxmox 3.0.2-rc05, a release candidate, so the version
  constraint alone is not enough if that tag is ever re-published.

- terraform.tfvars held one real secret (proxmox_api_token_secret) plus the
  entire vms map — 7 VMs with their vmids, sizes and static IPs. That is
  infra definition, and it existed only on one laptop. Meanwhile the
  committed terraform.tfvars.example still advertised web1/db1.

Split at the credential boundary: the provider auth triple stays in the
gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which
is committed and auto-loaded (no -var-file needed). terraform.tfvars.example
is now credentials-only. `tofu plan` reports no changes.

State stays ignored — it carries cloud-init attributes and should not be in
git. Noted in the README that it has no remote backend, and that state
manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tofu/nodito/README.md

@@ -27,16 +27,17 @@ This directory lets you declare VMs on the `nodito` Proxmox node and apply with
 - The Ansible template exists: `debian-13-cloud-init` (VMID 9001 by default).
 
 ### Provider Auth
-Create a `terraform.tfvars` (copy from `terraform.tfvars.example`) and set:
+Credentials are the only thing not in git. Copy `terraform.tfvars.example` to
+`terraform.tfvars` (gitignored) and set:
 - `proxmox_api_url` (e.g. `https://nodito:8006/api2/json`)
 - `proxmox_api_token_id` (e.g. `root@pam!tofu`)
 - `proxmox_api_token_secret`
-- `ssh_authorized_keys` (your public key content)
 
-Alternatively, you can export env vars and reference them in a tfvars file.
+Alternatively, export them as `TF_VAR_proxmox_api_token_secret` etc.
 
 ### Declare VMs
-Edit `terraform.tfvars` and fill the `vms` map. Example entry:
+VMs are declared in `vms.auto.tfvars`, which is committed. `*.auto.tfvars` is
+loaded automatically, so it needs no `-var-file`. Example entry:
 ```
 vms = {
   web1 = {
@@ -54,15 +55,24 @@ All VM disks are created on `zfs_storage_name` (defaults to `proxmox-tank-1`). N
 ### Usage
 ```
 tofu init
-tofu plan -var-file=terraform.tfvars
-tofu apply -var-file=terraform.tfvars
+tofu plan
+tofu apply
 ```
+`terraform.tfvars` and `vms.auto.tfvars` are both auto-loaded.
 
 > VMs are created once and then protected: the module sets `lifecycle.prevent_destroy = true` and ignores subsequent config changes. After the initial apply, manage day‑2 changes directly in Proxmox (or remove the lifecycle block if you need OpenTofu to own ongoing updates).
 
 ### Notes
 - Clones are full clones by default (`full_clone = true`).
 - Cloud-init injects `cloud_init_user` and `ssh_authorized_keys`.
+- `.terraform.lock.hcl` is committed: it pins the provider hashes, which matters
+  because `versions.tf` tracks a release candidate (`3.0.2-rc05`).
+- State is local (`terraform.tfstate`, gitignored) and has no remote backend, so
+  it exists only on the machine that last ran `tofu apply`.
+- The map is not a complete inventory of nodito: state also manages
+  `bastion-box` (1100) and `nonkeiwaisi-box` (3300), which are not declared in
+  `vms.auto.tfvars`. `tofu plan` is clean today, but relaxing the `lifecycle`
+  block without first declaring them would put them up for destruction.
 - Disks use `scsi0` on ZFS with `discard` enabled.