tofu: stop gitignoring the lock file and the VM inventory

The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which
hid two things that belong in version control:

- .terraform.lock.hcl pins the provider hashes. versions.tf tracks
  Telmate/proxmox 3.0.2-rc05, a release candidate, so the version
  constraint alone is not enough if that tag is ever re-published.

- terraform.tfvars held one real secret (proxmox_api_token_secret) plus the
  entire vms map — 7 VMs with their vmids, sizes and static IPs. That is
  infra definition, and it existed only on one laptop. Meanwhile the
  committed terraform.tfvars.example still advertised web1/db1.

Split at the credential boundary: the provider auth triple stays in the
gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which
is committed and auto-loaded (no -var-file needed). terraform.tfvars.example
is now credentials-only. `tofu plan` reports no changes.

State stays ignored — it carries cloud-init attributes and should not be in
git. Noted in the README that it has no remote backend, and that state
manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tofu/nodito/vms.auto.tfvars

@@ -0,0 +1,77 @@
+# Non-secret nodito infrastructure config. Auto-loaded by tofu (*.auto.tfvars),
+# so no -var-file is needed. Provider credentials live in terraform.tfvars,
+# which is gitignored.
+
+proxmox_node     = "nodito"
+zfs_storage_name = "proxmox-tank-1"
+template_name    = "debian-13-cloud-init"
+cloud_init_user  = "counterweight"
+
+# Public key injected into every VM via cloud-init.
+ssh_authorized_keys = <<EOKEY
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVC68uU7dTpZ8mDleakoBX6crnBdKNuvg6qeD73t+6L counterweightoperator@counterstation
+EOKEY
+
+# Note that the resources set here are designed for startup.
+# Some of these services are resource hungry at first, but
+# can be powered down after their bootstrap finishes.
+vms = {
+  "small-backups-box" = {
+    vmid         = 1200
+    name         = "small-backups-box"
+    cores        = 1
+    memory_mb    = 512
+    disk_size_gb = 100
+    ipconfig0    = "ip=dhcp"
+  },
+  "knots-box" = {
+    vmid         = 2100
+    name         = "knots-box"
+    cores        = 4
+    memory_mb    = 16384
+    disk_size_gb = 10
+    ipconfig0    = "ip=dhcp"
+  },
+  "fulcrum-box" = {
+    vmid         = 2200
+    name         = "fulcrum-box"
+    cores        = 1
+    memory_mb    = 2048
+    disk_size_gb = 10
+    ipconfig0    = "ip=dhcp"
+  },
+  "mempool-box" = {
+    vmid         = 2300
+    name         = "mempool-box"
+    cores        = 2
+    memory_mb    = 4096
+    disk_size_gb = 30
+    ipconfig0    = "ip=dhcp"
+  },
+  "memos-box" = {
+    vmid         = 8100
+    name         = "memos-box"
+    cores        = 1
+    memory_mb    = 1024
+    disk_size_gb = 10
+    ipconfig0    = "ip=dhcp"
+  },
+  "forgejo-runner-box" = {
+    vmid         = 3100
+    name         = "forgejo-runner-box"
+    cores        = 4
+    memory_mb    = 4096
+    disk_size_gb = 50
+    ipconfig0    = "ip=dhcp"
+  },
+  "arbret-staging-box" = {
+    vmid         = 3200
+    name         = "arbret-staging-box"
+    cores        = 2 
+    memory_mb    = 2048
+    disk_size_gb = 20
+    ipconfig0    = "ip=dhcp"
+  }
+}
+
+