tofu: stop gitignoring the lock file and the VM inventory

The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which
hid two things that belong in version control:

- .terraform.lock.hcl pins the provider hashes. versions.tf tracks
  Telmate/proxmox 3.0.2-rc05, a release candidate, so the version
  constraint alone is not enough if that tag is ever re-published.

- terraform.tfvars held one real secret (proxmox_api_token_secret) plus the
  entire vms map — 7 VMs with their vmids, sizes and static IPs. That is
  infra definition, and it existed only on one laptop. Meanwhile the
  committed terraform.tfvars.example still advertised web1/db1.

Split at the credential boundary: the provider auth triple stays in the
gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which
is committed and auto-loaded (no -var-file needed). terraform.tfvars.example
is now credentials-only. `tofu plan` reports no changes.

State stays ignored — it carries cloud-init attributes and should not be in
git. Noted in the README that it has no remote backend, and that state
manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tofu/nodito/terraform.tfvars.example

@@ -1,35 +1,7 @@
-proxmox_api_url           = "https://nodito:8006/api2/json"
-proxmox_api_token_id      = "root@pam!tofu"
-proxmox_api_token_secret  = "REPLACE_ME"
-
-proxmox_node = "nodito"
-zfs_storage_name = "proxmox-tank-1"
-template_name = "debian-13-cloud-init"
-cloud_init_user = "counterweight"
-
-# paste your ~/.ssh/id_ed25519.pub or similar
-ssh_authorized_keys = <<EOKEY
-ssh-ed25519 AAAA... your-key
-EOKEY
-
-vms = {
-  web1 = {
-    name         = "web1"
-    vmid         = 1101
-    cores        = 2
-    memory_mb    = 2048
-    disk_size_gb = 20
-    ipconfig0    = "ip=dhcp"
-  }
-
-  db1 = {
-    name         = "db1"
-    vmid         = 1102
-    cores        = 4
-    memory_mb    = 4096
-    disk_size_gb = 40
-    ipconfig0    = "ip=dhcp"
-  }
-}
-
+# Provider credentials. Copy to terraform.tfvars (gitignored) and fill in.
+# Everything else — the node, storage, template, SSH key and the vms map —
+# is committed in vms.auto.tfvars and needs no local copy.
 
+proxmox_api_url          = "https://nodito:8006/api2/json"
+proxmox_api_token_id     = "root@pam!tofu"
+proxmox_api_token_secret = "REPLACE_ME"