feat(proxmox): Proxmox VM template + Terraform/OpenTofu VM creation

Manual, documented bare-metal Proxmox install + cloud-init template build
(deliberately not automated — a fragile one-time step). Terraform/OpenTofu
config creates rn-platform-01/rn-lab-host-01 from that template via the
bpg/proxmox provider, with configurable (not hardcoded) VM sizing.

Validated: tofu fmt, tofu init -backend=false (real provider download),
tofu validate -> Success. No paid state backend required (local state).

infra/terraform/README.md

@@ -0,0 +1,44 @@
+# Proxmox VM creation (Terraform/OpenTofu)
+
+Creates `rn-platform-01` and `rn-lab-host-01` as Proxmox VMs from a cloud-init-enabled Ubuntu
+22.04 template. Assumes Proxmox VE is already installed and reachable (bare-metal install
+stays a manual, documented step — `docs/PRODUCTION_DEPLOYMENT.md` §2 — over-automating the one
+irreversible step that could brick the only way into the host is not worth it).
+
+Works with either Terraform or OpenTofu (the fork) — `bpg/proxmox` is available for both. Use
+whichever this project already has installed; nothing here is Terraform-Cloud-specific or
+requires a paid backend (state is local by default, `main.tf`'s commented-out `backend "s3"`
+block is there if remote state is ever wanted, not required).
+
+## Prerequisites (all deploy-time, hardware-dependent — cannot be done now)
+
+1. Proxmox VE installed, reachable at `proxmox_api_url`.
+2. A cloud-init-enabled Ubuntu 22.04 template already exists on the Proxmox host (packer/manual
+   — see `infra/proxmox/cloud-init/` for the cloud-init user-data this expects the template to
+   support; building the actual template is a one-time manual step, documented, not automated
+   here for the same "don't over-automate the fragile one-time step" reasoning as the Proxmox
+   install itself).
+3. A Proxmox API token with permission to create VMs (`terraform.tfvars`, never committed —
+   see `terraform.tfvars.example`).
+
+## Usage
+
+```bash
+cd infra/terraform
+cp terraform.tfvars.example terraform.tfvars   # fill in real values
+terraform init      # or: tofu init
+terraform plan
+terraform apply
+```
+
+Outputs the two VMs' IPs, which then go into `infra/ansible/group_vars/production.yml`
+(`platform_ip`, `lab_host_ip`) before running `infra/ansible/site.yml`.
+
+## What this does NOT do
+
+- Install Proxmox itself.
+- Build the base cloud-init template (one-time, manual, documented).
+- Decide final storage/ZFS layout (`vm_disk_datastore` is a variable — set it to whatever
+  datastore the real disk-inspection checklist, `docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md` §4,
+  says to use once the real disks are known).
+- Configure anything INSIDE the VMs — that's `infra/ansible/site.yml`'s job, run after `apply`.